trxpay[.]biz

The domain trxpay.biz has been assessed by PhishDestroy as an elevated-risk generic phishing threat, specifically targeting cryptocurrency users by impersonating a legitimate USDT to TRX conversion service. This domain was taken offline, but its history and technical indicators suggest it was designed to deceive users into revealing sensitive information or sending funds to malicious actors.

According to intelligence gathered, trxpay.biz was created on February 21, 2026, and registered through Global Domain Group LLC. The domain resolves to IP address 172.67.135.203 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal analysis shows that 2 out of 95 security vendors flagged this domain as malicious, and it appears on 3 security blocklists. The page title was "TRXPAY - Convert USDT to TRX," which is a common lure for crypto phishing schemes.

To protect against such threats, users should avoid interacting with any emails, messages, or websites associated with trxpay.biz. Never enter private keys, seed phrases, or login credentials on suspicious sites. If you have already engaged with this domain, change your passwords immediately and monitor your crypto wallets for unauthorized transactions. Report any phishing attempts to relevant authorities and consider using a reputable security solution to block similar domains in the future.