txdexc[.]cc

This domain, txdexc.cc, is actively engaged in credential theft operations targeting cryptocurrency users and financial platforms. Analysis indicates the site employs social engineering techniques to harvest login credentials, wallet keys, and personal identification details, which are then exploited for unauthorized account access or financial fraud. The infrastructure is designed to mimic legitimate crypto exchange interfaces, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on June 22, 2026, through NameSilo, LLC, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.97.3, which has been linked to other fraudulent schemes. Security vendors on VirusTotal flag txdexc.cc as malicious, with 14 out of 95 engines detecting it as a threat. Additionally, Google Safe Browsing has classified the domain under the SOCIAL_ENGINEERING category, confirming its use in deceptive practices. The SSL certificate issued by Google Trust Services provides a false sense of security, as encrypted connections are commonly exploited in phishing campaigns to evade detection. Users who have visited txdexc.cc or interacted with its content should take immediate action to mitigate potential risks. First, terminate any active sessions on the site and avoid entering any credentials or personal information. If login details were submitted, change passwords for all associated accounts, particularly those linked to cryptocurrency wallets or financial services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the respective platform. Forensic analysis of the device used to access the domain is recommended to check for malware or unauthorized data exfiltration. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.