buytron[.]org

This domain is flagged as a high-risk crypto scam impersonating Telegram, based on analysis conducted on July 12, 2026. The domain was registered on June 30, 2025 through Name.com, Inc. and resolves to IP address 194.135.34.50, hosted in Turkey on AS48207 (GLB Bulut Teknolojisi Limited Sirketi). The page title is 'BuyTron - USDT to TRX Exchange', and the HTTP status is 200, indicating the site is currently live and accessible. Infrastructure analysis reveals the server runs Ubuntu with Nginx, uses a Let's Encrypt R12 SSL certificate, and includes Google Analytics tracking. The domain appears on one security blocklist (PhishDestroy) and is flagged by 5 of 95 security vendors on VirusTotal. The Gridinsoft trust score is 0/100, and Scamadviser rates it at 41/100, both indicating low trust. The threat type is brand impersonation targeting Telegram, though the exact method of impersonation is not detailed in available intelligence. Defenders should treat this domain as actively malicious, block access at the network or DNS level, and monitor for any associated subdomains or IPs. Given the crypto exchange theme and low trust scores, users visiting this site may be at risk of credential theft or financial fraud. No phishing kit or additional scam infrastructure details are available at this time, so further analysis of the site's content and redirect chains is recommended to fully assess the attack vector.