gettrxx[.]org

PhishDestroy identifies gettrxx.org, a malicious domain actively impersonating a crypto wallet authorization interface to facilitate crypto drainer operations. The site was recently deployed with a page title 'walletauthorizer', indicating clear intent to deceive users into authorizing fraudulent cryptocurrency transactions. Current observations confirm the domain remains live and accessible.

This domain was flagged by 2 out of 95 VirusTotal vendors at the time of analysis, suggesting it has not yet been widely recognized by security tools. It is registered through NAMECHEAP INC, resolves to IP address 69.62.87.32, and was created on April 09, 2026. The domain uses a valid SSL certificate issued by Let's Encrypt, adding a false sense of legitimacy to its malicious content. Analysis indicates no entries in public blocklists as of this assessment.

While the domain remains active, it poses a significant risk to users interacting with cryptocurrency services, particularly those unaware of such impersonation schemes. Organizations and individuals are strongly advised to block the domain at the network level and inspect any recent browser history or transaction logs for signs of interaction. Implementing endpoint monitoring solutions to detect cryptocurrency wallet authorization prompts may also mitigate potential exposure.