trxpay[.]org

PhishDestroy identifies trxpay.org as an active crypto drainer domain impersonating a USDT to TRX conversion service. The domain is currently operational and leverages deceptive branding to lure victims into transferring cryptocurrency assets to attacker-controlled wallets. This represents a high-risk threat vector, particularly for users seeking to exchange or purchase TRON-based assets. trxpay.org was flagged by 3 of 95 VirusTotal vendors, indicating a low detection rate despite clear malicious intent. The domain was registered through Internet Domain Service BS Corp, resolves to IP address 188.114.97.3, and was created on April 21, 2026. The use of a Let's Encrypt SSL certificate suggests an attempt to appear legitimate, while the absence of blocklist entries highlights the importance of proactive threat monitoring. Trust scores remain critically low due to the domain's recent creation and lack of established reputation. The current status of trxpay.org is active and under investigation. Security teams are advised to block the domain at the network perimeter and update firewall rules to prevent outbound connections. Users should avoid accessing the site entirely, as it is designed to deceive visitors into connecting cryptocurrency wallets under false pretenses. If accidental interaction occurs, disconnect the wallet immediately, revoke any approved permissions, and monitor for unauthorized transactions. Report this domain to threat intelligence platforms and security vendors to improve collective defense against evolving crypto drainer campaigns.