trxuk[.]org

Analysis of trxuk.org indicates a newly registered domain (created 21 Feb 2026) that was used to host a crypto‑focused impersonation of the Telegram brand. The authoritative nameservers maleah.ns.cloudflare.com and miles.ns.cloudflare.com resolve the domain to 172.67.148.204, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate was presented, confirming the absence of HTTPS protection at the time of capture. The page title “Conversion USDT ⇄ TRX et achat d’énergie TRON | Rapide, sûr et fiable” aligns with the declared crypto‑scam classification and brand‑targeting of Telegram.

Reputation services rated the site at the lowest possible Gridinsoft trust score (0/100). The domain appears on three independent security blocklists and was actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal recorded two positive detections out of ninety‑five scanners, reinforcing the malicious assessment. The registrar listed is Internet Domain Service BS Corp., and the site’s current HTTP status is offline, suggesting the operators have taken the payload down or are rotating infrastructure.

Uncertainty remains regarding the exact phishing kit or any persistence mechanisms, as no further forensic artifacts were captured. Defenders should continue to deny connections to the resolved IP address, add the domain and its IP to local blocklists, and monitor for new registrations at the same registrar or with similar naming patterns. Because the hosting provider is Cloudflare, broader network‑level filtering of the AS13335 range should be considered only if collateral impact is acceptable. Ongoing threat‑intel feeds should be queried for re‑use of the same nameservers or page titles, and any future DNS queries for trxuk.org must be flagged for manual review.