butrx[.]org

The domain butrx.org is identified as a generic phishing infrastructure and is currently offline. This domain poses a significant risk of financial theft, particularly through the manipulation of TRX (Tron) and USDT (Tether) transactions.

Analysis indicates that butrx.org has been flagged by 6 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion among the cybersecurity community. The domain is registered through Cloudflare, Inc., and its SSL certificate is issued by Google Trust Services. It was created on July 29, 2025, and resolves to the IP address 188.114.96.3. The site has appeared on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL, and is referenced in 4 threat intelligence pulses on AlienVault OTX. The technologies detected on the site include Cloudflare Browser Insights, Cloudflare, and HTTP/3.

Given the current status of butrx.org as offline, it is recommended that network administrators and security teams continue to monitor the domain for any signs of reactivation. Additionally, users should be cautious when encountering similar domains and verify the legitimacy of any financial transactions involving TRX and USDT. Security awareness training should be reinforced to educate users about the common tactics used in phishing attacks, such as fake URLs and suspicious email communications.