trx-buy[.]icu

This domain, trx-buy.icu, operates as a cryptocurrency phishing site designed to harvest wallet credentials and private keys from users under the guise of a platform named Emerald Chain. The site mimics legitimate blockchain services, presenting a false interface to deceive victims into entering sensitive authentication details, which are then exfiltrated to attacker-controlled infrastructure. The threat specifically targets users of decentralized finance (DeFi) applications and cryptocurrency wallets, exploiting the growing adoption of digital assets to facilitate unauthorized transactions and asset theft. Analysis indicates trx-buy.icu was registered on February 21, 2026, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 83.217.208.8 and is currently flagged by 7 out of 95 security vendors on VirusTotal, including multiple cryptocurrency-specific detection engines. Additionally, the domain appears on three independent security blocklists, further corroborating its malicious classification. Infrastructure analysis reveals the site was taken offline following detection, though historical records confirm its active use in phishing campaigns prior to deactivation. Users who visited trx-buy.icu or interacted with its content should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. All credentials entered on the domain should be considered compromised, necessitating a reset of associated passwords and enabling multi-factor authentication where available. Monitoring for unauthorized transactions is critical, and affected users are advised to report the incident to relevant financial and cybersecurity authorities. Security teams should update blocklists to include trx-buy.icu and its resolving IP address to prevent further exposure within organizational networks.