trx-research[.]com

PhishDestroy has identified trx-research.com as an elevated-risk threat involving brand impersonation of the cryptocurrency exchange Bybit. This domain was designed to deceive users into thinking they were visiting an official Bybit audit portal, but its true purpose was to harvest credentials and potentially deploy a crypto drainer. The site is now offline, but users should remain vigilant as similar domains may still be active.

Technical analysis reveals that trx-research.com was created on February 21, 2026, and was hosted on IP address 172.86.70.121. VirusTotal flagged it with 19 out of 95 security vendors marking it as malicious, and it appeared on one security blocklist. The domain was also found in three AlienVault OTX threat intelligence pulses, indicating active monitoring by the security community. The SSL certificate was rated E7, suggesting a low trust level. The page title displayed was "Bybit Audit," which was a direct attempt to mimic legitimate Bybit audit pages.

To protect against this threat, users should never click on links claiming to be official Bybit audit pages received via unsolicited emails, messages, or social media. Always verify the authenticity of such communications by visiting the official Bybit website directly. If you have already interacted with trx-research.com, immediately change your Bybit account credentials and enable two-factor authentication. Monitor your accounts for any unauthorized transactions and contact Bybit support for further assistance. PhishDestroy continues to monitor for new threats and provides real-time verification tools to help users stay safe.