static[.]trxtransaction[.]info

This domain, static.trxtransaction.info, is actively involved in credential theft operations targeting cryptocurrency wallet users, specifically those interacting with the TRON (TRX) blockchain. The site presents a deceptive interface designed to mimic legitimate TRX transaction pages, tricking users into entering sensitive wallet credentials or private keys. Once captured, these credentials are likely used to drain funds from the victim's wallet, a tactic known as a crypto drainer attack. The page title 'test1' suggests either a placeholder or an early-stage deployment, but the infrastructure is fully operational and poses an immediate risk to unsuspecting users. Analysis indicates that static.trxtransaction.info is flagged by 3 out of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect its targeted nature or recent deployment. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 186.2.175.71, hosted in Belize under Iqweb LLC, a provider commonly linked to malicious activity. The SSL certificate is issued by Let's Encrypt (R12), which, while legitimate, is often exploited by threat actors to lend a false sense of security to phishing sites. The domain appears on one security blocklist, further confirming its malicious classification. If a user has visited static.trxtransaction.info or interacted with its content, immediate action is required to mitigate potential damage. First, disconnect the device from the internet to prevent further data exfiltration. Next, revoke any active sessions or approvals granted to the site via wallet applications, such as TRONLink or other TRX-compatible wallets. Users should assume their wallet credentials or private keys have been compromised and transfer any remaining funds to a new, secure wallet address. Scan the device for malware using updated security tools, as credential theft sites often deploy additional payloads. Monitor all linked accounts, including email and exchange platforms, for unauthorized access. Finally, report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actor's infrastructure.