buy-trx[.]ch

This domain, buy-trx.ch, is flagged as a crypto drainer phishing site targeting users of the TRON blockchain network. The page title, 'Buy TRX with USDT & TRON Energy Purchase | Fast, Secure, Reliable,' suggests an attempt to deceive victims into authorizing malicious transactions, likely draining cryptocurrency wallets. No explicit brand impersonation is evident, but the site mimics legitimate TRX purchasing platforms to exploit user trust in cryptocurrency services.

Analysis indicates the domain resolves to IP address 104.21.84.4 and is hosted behind Cloudflare, as evidenced by detected technologies including Cloudflare Browser Insights and HTTP/3. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and was identified in one threat intelligence pulse. Infrastructure analysis reveals the use of Cloudflare services, which may obscure further details about the hosting environment or registrar. No creation date or registrar information is currently available, limiting attribution efforts.

The domain is currently offline, reducing immediate risk to users. However, historical activity and the presence of crypto drainer indicators suggest prior malicious use. Response actions include blocking by multiple security providers, including wallet protection extensions and phishing detection systems. Remaining risk includes potential reactivation of the domain or migration of the phishing kit to alternative infrastructure. Users are advised to revoke any suspicious wallet authorizations and monitor for unauthorized transactions linked to this domain.