trxrent[.]io

Analysis of trxrent.io indicates a high-risk phishing domain targeting cryptocurrency users, specifically those interacting with TRX (Tron) and USDT (Tether) transactions. The domain was registered on March 28, 2026, and remains active as of July 12, 2026. Its page title, rendered in Russian, translates to 'TRX Energy Rental and USDT Exchange | Automatic Sending | trxRent.io,' suggesting an intent to deceive users into engaging with fraudulent crypto services. The domain resolves to IP address 188.114.96.3, which has been associated with 23 threat intelligence pulses on AlienVault OTX. It is currently listed on two security blocklists, including PhishDestroy and BLP-Malware. Three out of 95 security vendors on VirusTotal have flagged trxrent.io as malicious, though the absence of broader detection does not confirm safety. The domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as untrustworthy. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, a common tactic among phishing domains to appear legitimate. No evidence of a known phishing kit or specific brand impersonation has been confirmed beyond the page title's reference to TRX and USDT. Defenders should treat this domain as actively malicious, block resolution at the network level, and monitor for connections or credential submissions linked to it. Further investigation into associated wallet addresses or transaction patterns is recommended to assess potential financial impact.