buy-trx[.]de

PhishDestroy identifies buy-trx.de as an active credential-harvesting site disguised as a TRON (TRX) trading portal. The domain mimics legitimate crypto-exchanges to trick users into entering private keys or seed phrases, which are then sent to attacker-controlled servers rather than a real blockchain network. Unsuspecting visitors risk immediate loss of all funds stored in connected wallets.

This domain was flagged under seed 32b405 with zero detections on VirusTotal (1/95 engines) despite the obvious threat. It uses a publicly trusted Let’s Encrypt SSL certificate and resolves to Cloudflare IP 172.67.131.6, a common bulletproof fast-flux node used to hide origin infrastructure. Who-is records further reveal this domain was registered within the last 48 hours, indicating a brand-new trap rather than an established scam shop.

If you visited buy-trx.de: immediately close the tab, revoke any permissions granted to the site, transfer remaining funds to a brand-new wallet, and reset your device passwords. Scan for malware and enable two-factor authentication on every exchange or wallet you frequent. Report the domain to your local cyber-crime unit and to PhishDestroy’s automated takedown system using seed 32b405 so others remain protected.