buytrx[.]lu

PhishDestroy identifies buytrx.lu as an active crypto drainer phishing domain designed to trick users into connecting cryptocurrency wallets and draining funds. The domain mimics legitimate trading platforms to deceive visitors into authorizing malicious transactions. Security researchers have confirmed ongoing malicious activity associated with this domain.

This domain was flagged by 2 of 95 VirusTotal vendors, indicating limited but confirmed malicious detection. It was registered through Key-Systems GmbH and resolves to IP address 172.67.154.153 using a Let's Encrypt SSL certificate. While the exact creation date is not publicly available, its current active status and low VirusTotal detection rate suggest recent deployment aimed at evading initial scrutiny.

Due to elevated risk, PhishDestroy recommends blocking buytrx.lu at the network level and avoiding any interaction with the site. Users should verify URLs carefully when engaging in cryptocurrency transactions and use hardware wallets or transaction simulation tools. Security teams are advised to monitor for connections to IP 172.67.154.153 and flag any wallet connection attempts to this domain in security logs.