swap[.]trxyz[.]org

Analysis indicates that swap.trxyz.org is an active crypto‑scam infrastructure that impersonates the Tron brand. The domain was registered through Tucows Domains Inc. on 27 December 2025 and resolves to the Cloudflare address 172.67.175.111, which belongs to AS13335 in the United States. DNS resolution is served by the Cloudflare authoritative nameservers maleah.ns.cloudflare.com and miles.ns.cloudflare.com. The site presents the page title “USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable”, suggesting a fraudulent offer to exchange USDT for TRX and sell energy credits, consistent with the listed scam type “Crypto Scam”. The domain appears on one external security blocklist and has been flagged by PhishDestroy, confirming that it is currently blocked by at least one sink‑hole service.

VirusTotal scanning shows four of ninety‑three anti‑malware engines flag the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, indicating no confidence in the site’s legitimacy. No SSL certificate is observed, and the HTTP service is reported as taken offline at the time of analysis. The lack of HTTPS further reduces the site’s credibility and suggests a temporary deployment designed to evade automated TLS checks.

Defenders should immediately block the domain and its associated IP address in perimeter firewalls, DNS filtering, and endpoint protection solutions. Monitoring of additional domains that resolve to the same Cloudflare IP range is advisable, as the attacker may reuse the same edge infrastructure for future campaigns. Because the registrar is a widely used service, investigators may request domain‑ownership records from Tucows for potential takedown or attribution. Until the site is permanently taken down, continuous observation of the IP reputation and any new DNS entries under the same nameservers is recommended.