swap[.]trxcs[.]org

The domain swap.trxcs.org is a confirmed phishing site engaged in brand impersonation targeting the cryptocurrency platform Tron. It presents itself as a legitimate USDT to TRX swap and TRON energy rental service, but its sole purpose is to deceive users into disclosing wallet credentials or transferring funds under false pretenses. No cryptocurrency drainer kit was detected on this domain. As of the latest verification, swap.trxcs.org has been taken offline.

Technical analysis reveals that swap.trxcs.org was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). The domain was created on 2026-02-21 and resolves to the IP address 104.21.82.173, hosted on Cloudflare's infrastructure in the US (AS13335). Google Safe Browsing does not currently flag the domain. The SSL certificate is issued by WE1, and the observed page title is 'USDT to TRX Swap & TRON Energy Rental | Fast, Secure, Reliable'. No registrar information is available for this domain.

Users who interacted with swap.trxcs.org should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Monitor transaction history for unauthorized activity and report any losses to the relevant cryptocurrency exchange or wallet provider. Victims can report the phishing domain to their local cybercrime unit, the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org, or the impersonated brand's official security team. Enabling two-factor authentication on all accounts and using hardware wallets for cryptocurrency storage can reduce future risk.