buy-tron[.]workers[.]dev

The domain buy-tron.workers.dev was identified as a generic phishing site targeting cryptocurrency users. It posed as a platform for USDT to TRX swaps and TRON energy rentals, operating as a crypto scam with no affiliation to any legitimate brand or service. As of the latest verification, buy-tron.workers.dev has been taken offline, though its prior activity suggests it was designed to deceive users into transferring funds or disclosing sensitive information.

Technical analysis of buy-tron.workers.dev revealed minimal detection at the time of investigation, with 0 of 95 VirusTotal vendors flagging the domain. It was registered through Cloudflare, Inc. on January 10, 2026, and resolved to the IP address 188.114.97.3, hosted by Cloudflare in the US. The domain appeared on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. No SSL certificate was issued, and the observed page title was 'USDT to TRX Swap & TRON Energy Rental | Fast, Secure, Reliable'. Nameservers were paul.ns.cloudflare.com and meadow.ns.cloudflare.com.

Users who interacted with buy-tron.workers.dev should immediately revoke any token approvals granted to the site and transfer remaining funds to a new wallet. Monitor transaction histories for unauthorized activity and report the domain to relevant platforms, such as the hosting provider (Cloudflare) or crypto-specific fraud databases like MetaMask’s threat intelligence network. If credentials were entered, change passwords and enable two-factor authentication on all associated accounts to prevent further compromise.