buytrx[.]sbs

This domain, buytrx.sbs, operates as a crypto drainer phishing site targeting users of TRON-based services. It impersonates legitimate TRX swap and TRON energy providers, tricking victims into connecting wallets to malicious smart contracts that execute unauthorized transactions, draining funds without consent. The site specifically advertises "Independent TRX Swap and TRON Energy Service" as a lure to attract users seeking energy rental or token swaps on the TRON network, a common tactic in cryptocurrency phishing schemes. Analysis reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 4 out of 95 security vendors on VirusTotal, including detections for phishing and crypto-related fraud. It was registered through HOSTINGER operations, UAB, on May 06, 2026, with an unusually forward-dated creation timestamp suggesting potential obfuscation. The domain resolves to the IP address 145.79.58.115 and appears on three distinct security blocklists. Infrastructure analysis detects the use of LiteSpeed, Hostinger hosting, Google Analytics for tracking, Cloudflare Browser Insights, and HTTP/3, indicating a professionally maintained phishing operation rather than a low-effort scam. Users who visited buytrx.sbs or interacted with its content should immediately revoke any wallet permissions granted to the site. Check connected dApps and smart contract authorizations via wallet management tools, particularly for TRON-based contracts. Monitor transaction history for unauthorized transfers, especially those involving TRX or energy-related tokens. If funds were lost, report the incident to relevant blockchain analytics platforms and local cybercrime authorities. Avoid reusing credentials or wallet addresses associated with the domain, and verify future TRON service sites through official channels only.