tron[.]blockrecovery[.]live

PhishDestroy has identified tron.blockrecovery.live as a generic phishing domain specifically targeting users of the TRON blockchain by impersonating a USDT TRC20 transfer interface. The domain is currently offline, but during its active period it posed a significant threat to cryptocurrency holders seeking to transfer Tether tokens on the TRC20 network.

This domain was flagged by 6 of 95 VirusTotal security vendors, indicating moderate but definitive malicious consensus. It appears on two security blocklists and was registered through NameCheap, Inc. on May 16, 2026, a future date that suggests possible data manipulation or a registrar error. The domain resolves to IP address 35.157.26.135 and uses a Let's Encrypt SSL certificate (E7), which is common among both legitimate and fraudulent sites. The page title, "Transfer USDT TRC20," is a direct attempt to deceive users into connecting their wallets or entering private keys, leading to asset theft.

Given that the domain is now offline, the immediate risk is mitigated, but PhishDestroy recommends users remain vigilant against similar phishing attempts. Always verify the legitimacy of any site requesting wallet connections or sensitive information, especially those involving cryptocurrency transfers. Use trusted bookmarks, enable two-factor authentication, and avoid clicking on unsolicited links. For further details, consult the full report and consider reporting any related domains to security authorities.