buytrx[.]shop

PhishDestroy has flagged buytrx.shop as an active crypto drainer scam under investigation, following the detection of a fraudulent domain designed to trick cryptocurrency holders into connecting their wallets to a malicious smart contract. This domain mimics legitimate cryptocurrency trading platforms, specifically targeting users searching for 'buy trx' or related terms, and is engineered to siphon funds from unwitting victims. The site employs a drainer kit capable of executing unauthorized transfers upon wallet connection, posing a severe financial risk to cryptocurrency users. This domain was registered through Turingsign Inc. on March 31, 2026, and resolves to IP address 104.21.0.214. VirusTotal currently shows a 1/95 detection rate for this domain, indicating it has not yet been widely flagged by security vendors. The domain secured an SSL certificate from Let’s Encrypt, which is commonly exploited by threat actors to lend false legitimacy to phishing sites. Notably, the domain remains unlisted on Google Safe Browsing (GSB) and has not yet been included in major threat intelligence blocklists, leaving users vulnerable to exposure. As of this report, buytrx.shop remains active and poses an ongoing threat to cryptocurrency users. PhishDestroy has escalated this intelligence to relevant authorities, including law enforcement and cybersecurity alliances, to expedite takedown efforts. While the immediate risk is high due to the domain’s undetected status, users are strongly advised to avoid interacting with this site, verify all URLs before wallet connections, and report any suspicious activity to their security teams or platforms like PhishDestroy. The residual risk remains elevated until proactive blocking measures are universally implemented.