trx-new[.]org

Analysis of trx-new.org indicates a short‑lived crypto‑drain phishing infrastructure that was taken offline prior to the report date of July 24, 2026. The domain was registered on February 21, 2026 through Global Domain Group LLC and resolves to the IPv6 address 2606:4700:3030::6815:632, which belongs to Cloudflare, Inc. (AS13335) in the United States. The site presented the Cloudflare page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code, suggesting that access was deliberately blocked or the site was deliberately shut down. Technical fingerprints show a modern web stack comprising Node.js, React, Next.js, Webpack and HTTP/3, all delivered behind Cloudflare’s CDN and protected by a Google Trust Services / WE1 SSL certificate.

The domain appears on one public blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans recorded ten detections out of ninety‑five security vendors, reinforcing the malicious classification. AlienVault OTX listed the domain in a single threat‑intel pulse, providing additional corroboration of its use in a crypto‑related scam. While the exact target brand or victim‑facing page content has not been disclosed, the classification as a "Crypto Scam" aligns with the observed tooling and the rapid takedown pattern.

Defenders should continue to block the domain at network perimeter devices, update DNS blocklists with the IPv6 address and associated nameservers (eleanor.ns.cloudflare.com, tosana.ns.cloudflare.com), and monitor for any re‑registration attempts. Since the site is currently offline, retrospective log analysis for connections to the listed IP and domain may reveal compromised credentials or attempted fund transfers. Ongoing vigilance is advised, especially for users who may have interacted with the site before its shutdown, as credential or wallet information could have been exfiltrated during its brief active window.