gettrxs[.]org

PhishDestroy identifies gettrxs.org as a Bitcoin wallet drainers phishing site, currently under active investigation as of seed 8d2177. The domain poses a significant risk to crypto investors by masquerading as a legitimate transaction service while embedding malicious drainer scripts designed to empty Bitcoin wallets. No specific brand impersonation or known drainer kit (e.g., Angel Drainer, Inferno Drainer) has been publicly attributed to this domain yet, but its phrasing and infrastructure suggest a targeted campaign against digital asset holders.

This domain exhibits several concerning technical indicators: it resolves to IP 69.62.87.32, is registered through NAMECHEAP INC, and was created on April 13, 2026. VirusTotal currently flags it at 1/95 detections, indicating it remains undetected by most antivirus engines. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate malicious intent but reflects a common tactic among phishing domains to appear legitimate. This domain has not yet been added to Google Safe Browsing (GSB) lists or major blocklists, leaving users exposed without prior warnings.

While flagged as under investigation, this domain represents an active and evolving threat. Response actions include domain takedown requests submitted to NAMECHEAP and IP-based blocking at the network perimeter. However, the absence of detections and blocklist entries suggests a high-risk window where users may unknowingly interact with the site. Remaining risk includes potential expansion of the drainer campaign, integration with bulletproof hosting, or rapid domain rotation to evade detection. Immediate mitigation includes user education against unsolicited transaction links, wallet address verification, and enterprise-level DNS/URL filtering with real-time threat intelligence feeds.