taketrx[.]org

The domain taketrx.org was registered on April 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted behind Cloudflare (IP 104.21.78.39, located in Canada). It resolves to the Cloudflare nameservers tom.ns.cloudflare.com and ximena.ns.cloudflare.com and presents a valid Let’s Encrypt certificate (E8). The site returns HTTP 200 and its page title reads “Instant USDT → TRX Swap”, indicating a lure aimed at users interested in cryptocurrency swaps. Threat intelligence flags the domain as high‑risk: Gridinsoft assigns a trust score of 0/100, it appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal reports a single detection out of 94 scanners, and AlienVault OTX lists the domain in one pulse. While the limited number of antivirus detections suggests low coverage, the combination of a newly created domain, a crypto‑swap lure, a zero‑trust score, and active blocklist entries strongly points to a phishing operation. Defenders should immediately block taketrx.org at perimeter and DNS layers, monitor for related C2 traffic to the Cloudflare IP range, and consider adding the domain to internal threat‑intel feeds. Continued observation is advised to detect any evolution of the campaign, but current evidence supports treating the site as a confirmed phishing vector.