trxnd[.]org

The domain trxnd.org has been identified as a crypto drainer phishing site, specifically targeting users seeking USDT to TRX cryptocurrency conversions. Analysis indicates the domain is currently offline, though it previously hosted malicious infrastructure designed to siphon digital assets from unsuspecting victims. The threat type is classified as a crypto drainer, a specialized form of phishing that exploits wallet connections to initiate unauthorized transactions. Infrastructure analysis reveals the domain was registered on March 5, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which is part of a network known for hosting phishing and fraudulent activities. Detection metrics show the domain is flagged by 6 of 95 security vendors on VirusTotal, while independent trust scoring systems, such as Gridinsoft, assign it a trust score of 0 out of 100. The domain appears on three security blocklists and has been actively blocked by multiple threat intelligence platforms. Technologies detected on the site include Cloudflare and Cloudflare Browser Insights, which are often leveraged to obfuscate malicious activity and evade detection. As of the latest assessment, trxnd.org has been taken offline, though the infrastructure remains a latent threat. Users are strongly advised to verify the legitimacy of any cryptocurrency conversion tools before interacting with them. Wallet connections should only be authorized on verified, official platforms. Organizations are recommended to update their blocklists to include this domain and its associated IP address, while individuals should monitor transaction histories for unauthorized activity. Proactive measures, such as disabling wallet permissions for unknown sites and employing browser-based security extensions, are critical to mitigating similar threats.