trx-buyer[.]com

The domain trx-buyer.com has been identified as a brand impersonation threat targeting Binance, a major cryptocurrency exchange platform. This domain operates under the guise of a TRON (TRX) exchange service, specifically labeled as "TRX BUYER - Fast & Secure TRON Exchange," to deceive users into disclosing sensitive account credentials or transferring digital assets. As of the latest assessment, the domain is currently offline, though its infrastructure remains a potential vector for future malicious activity. Analysis of trx-buyer.com reveals critical technical indicators associated with phishing operations. The domain was registered through Dominet (HK) Limited on November 12, 2025, and resolves to the IP address 172.67.198.251. Despite its recent creation, it has already been flagged on one security blocklist, while Gridinsoft assigned it a trust score of 0/100. VirusTotal detections remain at 0/95, indicating that no antivirus vendors have explicitly flagged the domain at this time. The domain's page title and branding closely mimic Binance’s TRON-related services, increasing the likelihood of successful social engineering attacks. Given the domain’s current offline status, the immediate risk of active exploitation is mitigated; however, the infrastructure may be reactivated or repurposed. Organizations and users are advised to block the domain and its associated IP (172.67.198.251) at the network perimeter. Security teams should monitor for any resurgence of trx-buyer.com or similar domains registered under the same registrar (Dominet HK Limited) with comparable naming conventions. End-users should verify the authenticity of cryptocurrency exchange platforms by cross-referencing official domains and enabling multi-factor authentication to prevent credential theft.