trxbuyer[.]net

The domain trxbuyer.net was registered on February 21, 2026 and presently resolves to the IP address 172.67.135.215, which is hosted by Cloudflare (AS13335) in the United States. The authoritative name servers listed for the zone are 2-nest.pipe.ma, 1-ceci.njalla.do, and 3-pas.njalla.in, indicating the use of a third‑party DNS provider. An SSL certificate identified as WE1 is presented for the site, and the page title returned by the HTTP response is "TrxBuyer.net | Leading on Tron," suggesting a focus on the Tron blockchain ecosystem.

The domain is classified as a wallet/seed phishing campaign that impersonates multiple brands, as indicated by the generic "across" target label. Detection data shows that three of ninety‑three security vendors on VirusTotal have flagged the domain, and it appears on a single security blocklist. The PhishDestroy service has also blocked the domain.

As of the report date, the site status is recorded as taken offline. Defenders should continue to block DNS resolution to 172.67.135.215, enforce URL filtering against the domain, and monitor for any re‑registration attempts. Because the site is no longer serving content, further content‑level analysis is not possible, and the current intelligence is limited to infrastructure and detection telemetry.