trxnetwork[.]app

This domain, trxnetwork.app, is under active investigation for generic phishing activity. It was registered on May 07, 2026, through Dynadot LLC, and resolves to IP address 172.67.208.226, which is hosted by Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services, and the domain uses Cloudflare nameservers. The page title is currently 'Just a moment...' and the HTTP status code returned is 502, indicating a gateway error, which may suggest the phishing site is temporarily unavailable or behind a protection layer.

The domain has been flagged by PhishDestroy and appears on one security blocklist. It is also recorded in one threat intelligence pulse on AlienVault OTX. Despite these indicators, VirusTotal shows zero detections out of 95 engines, meaning the domain has not yet been widely recognized as malicious by automated scanners. Gridinsoft gives it a trust score of 0 out of 100, reinforcing the suspicion that this domain is not legitimate. The domain remains active as of the report date.

Uncertainty remains about the exact phishing campaign this domain is associated with. The 502 error and Cloudflare hosting may be part of an attempt to obscure the backend infrastructure or to evade analysis. No brand, kit, or specific phishing type has been confirmed from the available data. The lack of VirusTotal detections does not confirm safety, as many phishing domains evade initial detection.

Defenders should monitor this domain for changes in HTTP status or page content, as a functional phishing page may appear later. Network teams should block outbound traffic to 172.67.208.226 and trxnetwork.app at the proxy or firewall level. Email security filters should quarantine any messages linking to this domain. Re-checking VirusTotal and AlienVault OTX periodically will help track if the domain becomes more widely flagged. Any users who may have interacted with the site should be advised to change credentials and enable multi-factor authentication.