shrill-haze-5ff7[.]buytrx[.]workers[.]dev

The domain shrill-haze-5ff7.buytrx.workers.dev is a phishing site engaged in brand impersonation targeting Telegram users with a crypto scam. It presented itself as a legitimate platform for USDT to TRX conversion and TRON energy purchases, but its true purpose was to deceive victims into transferring cryptocurrency under false pretenses. No drainer kit was identified, and the site is currently taken offline.

Technical analysis shows shrill-haze-5ff7.buytrx.workers.dev was flagged by 2 of 95 VirusTotal security vendors, including ADMINUSLabs and Fortinet. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 104.21.5.3, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable'. The site returned an HTTP 403 status at the time of assessment, with a Gridinsoft trust score of 0/100.

Victims of shrill-haze-5ff7.buytrx.workers.dev should immediately revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new wallet. If credentials were entered, change passwords for associated accounts and enable two-factor authentication. Report the phishing domain to Cloudflare abuse channels, Google Safe Browsing, and platforms like PhishTank or OpenPhish. Monitor transaction histories for unauthorized activity and consider filing a report with local cybercrime authorities.