trx-exchange[.]org

The domain trx-exchange.org is a brand impersonation phishing site that specifically targets the Bitget cryptocurrency exchange brand. It poses as a legitimate exchange platform under the title 'TRX Exchange • Trusted by 100,000+ traders' and is designed to deceive users into connecting their wallets, which constitutes a wallet connect phishing scam. The site has been taken offline, but its previous activity posed an elevated risk to users.

Technical analysis shows that trx-exchange.org was flagged by 5 of 95 VirusTotal vendors, including alphaMountain.ai, CyRadar, and Fortinet. It was registered through Web Commerce Communications Limited on September 1, 2025, at 19:06:42, and resolves to IP address 172.67.143.40, which is located in the US and hosted by Cloudflare, Inc. (AS13335). The domain appears on 1 security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0 out of 100. No SSL certificate was issued for this domain, and the HTTP status returned was 429. Google Safe Browsing did not flag the domain.

Users who may have interacted with trx-exchange.org should take immediate safety steps. Since the scam involves wallet connect phishing, affected individuals should revoke any token approvals granted to the site and move their cryptocurrency funds to a new, secure wallet. Changing passwords and enabling two-factor authentication on all related accounts is also recommended. To report this phishing domain, users can submit details to blocklists like PhishDestroy or to the impersonated brand Bitget's security team.