trx-buy[.]org

This domain, trx-buy.org, is actively engaged in cryptocurrency phishing operations targeting users of the TRON (TRX) and Tether (USDT) ecosystems. The site presents itself as a legitimate platform for converting USDT to TRX and purchasing TRON network energy, using the page title 'Conversion USDT ⇄ TRX et achat d’énergie TRON | Rapide, sûr et fiable.' The fraudulent interface mimics official exchange services, likely prompting users to enter wallet credentials, recovery phrases, or authorize malicious transactions, leading to direct asset theft or unauthorized access to digital wallets. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on May 29, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate the true origin of phishing infrastructure. The domain is flagged by 5 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate, issued by Let's Encrypt (YE2), provides encryption but does not validate legitimacy, as certificates are routinely issued to malicious domains. Users who have visited trx-buy.org or interacted with its content should immediately cease all engagement and revoke any wallet permissions granted. It is critical to audit connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet. If credentials or recovery phrases were entered, assume full compromise and monitor associated accounts for suspicious activity. Reporting the domain to relevant security platforms and financial service providers can aid in broader mitigation efforts. Given the domain's active status and high-risk classification, continued exposure poses significant financial and operational threats.