buytrx[.]com

This domain, buytrx.com, is flagged as a crypto drainer phishing site specifically designed to facilitate fraudulent TRX cryptocurrency transactions. Analysis indicates the site presents a simulated trading interface under the guise of enabling TRX purchases with USDT, a common tactic used to deceive users into authorizing malicious token transfers. No legitimate brand affiliation is observed, though the interface mimics generic cryptocurrency exchange layouts to enhance credibility. The absence of a known drainer kit signature suggests either custom development or obfuscated payload delivery at runtime. Infrastructure analysis reveals the domain was registered on May 17, 2026, through GoDaddy.com, LLC, an unusual future-dated creation that may indicate registry manipulation or misreporting. The domain resolves to IP address 104.21.47.36, hosted behind Cloudflare infrastructure, which provides both content delivery and SSL termination via a Google Trust Services certificate. Detection metrics show the domain is currently flagged by 3 out of 95 security vendors on VirusTotal, with active blocking by three independent security blocklists. Technologies detected include Cloudflare Browser Insights and HTTP/3, indicating modern web stack usage likely intended to evade basic detection mechanisms. As of the latest assessment, buytrx.com has been taken offline, though prior malicious activity may persist in cached or archived states. The domain's future-dated registration and use of bulletproof hosting infrastructure suggest potential for re-emergence under similar or altered identifiers. Users who interacted with this domain should immediately revoke any connected wallet authorizations and monitor transaction histories for unauthorized token movements. The elevated risk level remains due to the financial nature of the threat, despite current inaccessibility.