nltrx[.]com

This domain, nltrx.com, operates as a crypto drainer specifically designed to target users of the TRON blockchain ecosystem. The site impersonates a legitimate TRON Energy purchase and USDT to TRX conversion service, presenting itself as "Fast, Secure, Reliable" to deceive victims into connecting their wallets. Once connected, the malicious infrastructure likely executes unauthorized transactions, draining cryptocurrency assets from unsuspecting users. The threat is particularly insidious due to its targeted approach, leveraging the growing popularity of TRON-based decentralized applications and energy rental services. Analysis of the domain reveals multiple indicators of malicious activity. The domain was registered on April 03, 2026, through Internet Domain Service BS Corp., an entity frequently associated with high-risk registrations. It resolves to the IP address 104.21.73.113 and is protected by Cloudflare, a common tactic to obscure server infrastructure. Security vendors have flagged the domain, with 1 out of 95 on VirusTotal identifying it as malicious, while Gridinsoft assigns it a trust score of 0/100. Additionally, the domain appears on three security blocklists and is actively blocked by multiple wallet security extensions. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as it is commonly used by both legitimate and malicious sites alike. Detected technologies include Cloudflare Browser Insights and HTTP/3, further indicating an attempt to mimic modern, secure web services. Users who have visited nltrx.com or interacted with its content should immediately take protective measures. Disconnect any wallet applications linked to the site and revoke all associated smart contract approvals using a trusted blockchain explorer. Scan the device for malware, as crypto drainers may deploy additional payloads. Monitor wallet activity for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. Report the domain to relevant security communities and avoid interacting with any communications or prompts originating from nltrx.com or similar domains. Given the active status of this threat, heightened vigilance is advised when engaging with TRON-related services.