buy-trx[.]com

Analysis of buy-trx.com indicates a high-risk crypto drainer phishing domain active as of July 12, 2026. The domain was registered on July 7, 2026, through Internet Domain Service BS Corp., with nameservers damien.ns.cloudflare.com and lisa.ns.cloudflare.com, pointing to Cloudflare infrastructure. It resolves to IP 104.21.30.152 (AS13335, Cloudflare, Inc., US) and returns an HTTP 200 status. The page title, 'Buy TRX with USDT & TRON Energy Purchase | Fast, Secure, Reliable,' suggests targeting of cryptocurrency users, specifically those transacting in TRX (TRON) and USDT (Tether). Known intelligence classifies this as a crypto drainer scam, a type of phishing attack designed to siphon digital assets from victims' wallets. Security vendors have flagged the domain, with 3 of 91 detections on VirusTotal. It appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), and detected technologies include Cloudflare Browser Insights and HTTP/3. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. No legitimate association with TRON or USDT trading platforms is confirmed. Defenders should treat this domain as active and high-risk. Block resolution at the DNS level and monitor for connections to 104.21.30.152. Given the use of Cloudflare, IP-based blocking may affect unrelated services, so domain-specific mitigations are recommended. The short registration window (5 days old) aligns with typical phishing domain lifecycle patterns, suggesting potential volatility in hosting or infrastructure changes. Further analysis of the site's backend or wallet addresses may provide additional indicators for tracking or takedown efforts.