trxinfo[.]shop

PhishDestroy identifies trxinfo.shop as an active crypto drainer scam deployed to steal cryptocurrency assets from unsuspecting users. This domain leverages deceptive tactics to trick victims into connecting wallets or authorizing fraudulent transactions, resulting in irreversible fund loss. The threat remains unflagged on VirusTotal despite clear malicious intent, underscoring the need for proactive detection and sharing of threat intelligence within the security community.

This domain, trxinfo.shop, exhibits multiple red flags across key threat intelligence sources. VirusTotal currently reports 1 out of 95 antivirus engines detecting the threat, indicating a critical gap in signature-based detection. The domain resolves to IP 82.112.239.11, which is associated with hostile infrastructure hosting multiple phishing campaigns. The SSL certificate is issued by Let’s Encrypt, a trusted provider often abused by malicious actors to lend false legitimacy to fraudulent sites. The domain uses a recently registered top-level domain (.shop), though exact creation date is pending further registry analysis. It has not yet been listed on major public blocklists such as PhishTank or OpenPhish, increasing the risk of unchecked victim exposure.

To mitigate exposure to this crypto drainer scam, users should immediately block trxinfo.shop at the network and DNS levels. Avoid clicking any links or connecting cryptocurrency wallets to this domain. Enable wallet transaction simulation tools or use hardware wallets with screen protection to prevent unauthorized approvals. Organizations are advised to deploy DNS filtering rules and integrate threat intelligence feeds that include real-time domain reputation checks. Sharing this IOC (trxinfo.shop, 82.112.239.11) across threat-sharing platforms will help raise collective detection rates and protect the broader ecosystem from cryptocurrency theft.