trxos[.]org

Analysis of trxos.org, observed as a crypto‑scam infrastructure targeting users of the TRON platform, indicates the domain was actively serving a malicious page titled “USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable”. The domain was registered through Internet Domain Service BS Corp. on 15 December 2025 and resolves to the Cloudflare edge address 104.21.93.71, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. Both authoritative nameservers are lakas.ns.cloudflare.com and opal.ns.cloudflare.com, confirming that the domain leveraged Cloudflare’s DNS and DDoS protection services. The site presented a valid SSL certificate issued by Google Trust Services (certificate label WE1), enabling HTTPS connections over HTTP/3. Reputation data shows a Gridinsoft trust score of 0 / 100 and placement on a single security blocklist.

VirusTotal analysis recorded three positive detections out of ninety‑three scanned vendors, reinforcing the malicious classification. The domain is currently listed as offline, and the phishing‑related blocklist PhishDestroy has already added it to its deny list. Observed indicators suggest a classic crypto‑drain operation that attempts to lure victims into converting USDT to TRX and purchasing “TRON Energy”. The use of a legitimate‑looking page title and a trusted TLS certificate is consistent with attempts to gain victim confidence.

However, the exact payload, form fields, or post‑conversion mechanics have not been captured, leaving the precise method of fund exfiltration uncertain. Defenders should block DNS resolution for trxos.org and any sub‑domains, enforce TLS inspection to capture potential credential or wallet address submissions, and monitor outbound connections to the Cloudflare IP 104.21.93.71 for anomalous traffic patterns. Threat‑intel feeds should be updated with the domain’s creation date, registrar, and the three VirusTotal detections to improve correlation across detection platforms.