trxmm[.]org

This domain, trxmm.org, is identified as a crypto drainer phishing site designed to target users of the TRON blockchain network. The site impersonates legitimate TRON energy rental and USDT-to-TRX swap services, presenting itself under the page title 'TRON Energy Rental and USDT to TRX Swap | Simple and Secure.' Analysis indicates the presence of a likely crypto wallet drainer kit, which aims to trick victims into connecting their wallets, authorizing malicious transactions, and subsequently draining their funds. The site’s infrastructure and branding are crafted to mimic official TRON services, increasing the likelihood of successful social engineering attacks against unsuspecting users. Technical indicators confirm the malicious nature of trxmm.org. The domain resolves to the IP address 69.10.53.212 and was registered on April 13, 2026, through Global Domain Group LLC. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, and additional analysis reveals the use of Node.js, React, Nginx, Next.js, Google Analytics, Webpack, and HTTP/3 technologies. Despite its offline status, the domain’s infrastructure and registration details align with known phishing patterns, particularly those targeting cryptocurrency users. As of the latest assessment, trxmm.org has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain remains a residual risk due to its recent activity and the potential for re-emergence under a different name or IP address. Users who interacted with the site are advised to revoke any connected wallet authorizations, monitor their transaction history for unauthorized activity, and report the domain to relevant security platforms. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.