trxminego[.]live

The domain trxminego.live was registered through Porkbun LLC on July 25, 2025 and is currently hosted on Cloudflare’s network (AS13335). DNS resolution points to the IP address 188.114.97.3, which is located in the United States. The authoritative nameservers are katelyn.ns.cloudflare.com and pete.ns.cloudflare.com, and the site served content over HTTP/3 using a TLS certificate issued by Google Trust Services under the WE1 profile. The page title observed during the brief crawl was "TRX MINE - EARN FREE TRX," indicating a crypto‑related lure that impersonates the Tron brand.

Security assessments show a Gridinsoft trust score of 48 out of 100, and the domain is listed on one security blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. VirusTotal scans recorded 14 detections out of 95 security vendors, reinforcing the malicious classification. The threat vector aligns with a crypto scam that leverages brand impersonation to entice victims into mining or claiming free TRX tokens.

While the infrastructure details such as the hosting provider and SSL chain are confirmed, the exact payload or victim‑interaction flow has not been publicly disclosed, leaving the precise infection mechanism uncertain. Defenders should continue to block the domain at perimeter filters, monitor for any residual traffic to the associated IP address, and update threat intelligence feeds with the observed indicators of compromise, including the domain name, IP, nameservers, and TLS certificate details. Continuous re‑evaluation is advised in case the actors reactivate the site or reuse the same infrastructure for new campaigns.