trxem[.]com

PhishDestroy has flagged trxem.com as an active crypto drainer domain designed to impersonate a legitimate cryptocurrency platform. The threat actor leverages a deceptive domain name to trick users into connecting their wallets or entering sensitive credentials, which are then harvested for unauthorized fund transfers. This domain is currently under investigation but remains accessible and poses a direct risk to cryptocurrency users. This domain was registered on April 02, 2026 through Internet Domain Service BS Corp. and resolves to IP address 172.67.200.33. VirusTotal currently shows 3/95 detections, indicating it has not yet been widely flagged by security vendors. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate. PhishDestroy’s unique seed analysis (d76bbd) confirms this is a newly active threat with low detection coverage, increasing the risk of successful exploitation. If you visited trxem.com or entered any information, disconnect your wallet immediately and revoke any unauthorized permissions via your wallet’s security settings. Do not interact with this domain further. Report the URL to your antivirus provider, browser vendor, and platforms like PhishDestroy using the unique seed identifier d76bbd for enhanced tracking and takedown efforts.