swap[.]trxgb[.]org

swap.trxgb.org is flagged as a brand‑impersonation site targeting the cryptocurrency brand Tron. The domain was registered on 22 December 2025 through Internet Domain Service BS Corp. and is currently taken offline, as indicated by the status field. DNS resolution points to the IP address 172.67.188.241, which belongs to the Cloudflare network (AS13335) and is physically located in the United States. Both authoritative name servers, maleah.ns.cloudflare.com and miles.ns.cloudflare.com, are Cloudflare‑provided, suggesting the attacker leveraged Cloudflare’s CDN and DDoS protection services to hide the true hosting environment. No TLS certificate was observed for the domain, meaning HTTPS connections would be unavailable or would fall back to HTTP, a characteristic often seen in hastily deployed fraudulent pages. Content analysis is limited to the page title returned by the HTTP response: “USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable”.

The title explicitly mentions TRX and TRON, reinforcing the claim of brand impersonation, and aligns with the classified scam type “Crypto Scam”. No additional page content has been captured, so the exact layout, credential‑phishing forms, or malicious scripts remain unknown. Reputation services provide mixed signals. VirusTotal recorded detections from 2 of 93 scanning engines, indicating that at least a small subset of security products identified malicious behavior. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist, confirming that at least one anti‑phishing organization has taken action against it.

Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, which further corroborates the malicious intent. Given the observable infrastructure, defenders should block DNS resolution to 172.67.188.241 for any internal clients, enforce strict HTTPS‑only policies to prevent fallback to insecure HTTP, and add swap.trxgb.