trc20support[.]buzz

Analysis of trc20support.buzz as of July 28, 2026, indicates this domain is actively serving a high-risk phishing site targeting TRON (TRC-20) cryptocurrency users. The domain was registered through OwnRegistrar, Inc., and remains operational with an HTTP 200 status, confirming the server is responding to requests. Infrastructure analysis reveals the domain is hosted on nameservers pl1.managedns.org, pl2.managedns.org, pl3.managedns.org, and pl4.managedns.org, which are frequently associated with bulletproof or low-reputation hosting providers. VirusTotal detection data shows 5 out of 91 security vendors have flagged trc20support.buzz as malicious, a detection rate consistent with active but not yet widely recognized phishing campaigns.

The domain appears on one security blocklist, and it has been preemptively blocked by PhishDestroy, a specialized anti-phishing service. No Safe Browsing or Open Threat Exchange (OTX) records were provided in the available intelligence, so broader browser-based protections may not yet be universally applied. The domain name itself, incorporating 'trc20support', strongly suggests an intent to deceive users seeking TRON blockchain support or wallet services. However, the exact content of the site has not been confirmed through automated or manual analysis, so specific tactics—such as fake wallet interfaces, token recovery scams, or smart contract drainers—remain unconfirmed.

Defenders should treat this domain as a confirmed phishing asset due to its naming convention, hosting infrastructure, and detection by multiple security vendors. Network-level blocking is recommended, and security teams should monitor for related domains using similar naming patterns (e.g., trx-support, tron20-help) that may emerge as part of the same campaign. No SSL certificate details or associated IP addresses were provided, limiting further infrastructure attribution at this time.