Analysis of trxfee.net indicates that the domain was registered on July 31, 2026 through PublicDomainRegistry.com (operated by PDR Ltd.) and is currently active. The authoritative nameservers are khalid.ns.cloudflare.com and ligia.ns.cloudflare.com, pointing to the Cloudflare edge at IP address 172.67.182.209. The domain has been observed on a single security blocklist and is actively blocked by the PhishDestroy filtering service.
VirusTotal records show that the domain was examined by 91 scanning engines, none of which reported a detection at the time of the scan; this absence of alerts does not constitute a safety guarantee. No additional intelligence such as SSL certificate details, HTTP response codes, or page titles is presently available. The limited data points suggest a typical phishing infrastructure that leverages Cloudflare’s CDN to obscure the origin server and benefits from recent registration to evade legacy reputation systems.
Defenders should proactively block trxfee.net at the DNS and network layers, add the domain to internal blocklists, and monitor for any related sub‑domains or newly observed activity tied to the same IP address. Continuous re‑assessment is advised, as the threat remains under investigation and could evolve with further infrastructure changes.