tronexchange[.]com

This domain, tronexchange.com, is actively impersonating GoDaddy infrastructure as part of a fake exchange scam. Registered on December 20, 2017, through GoDaddy.com, LLC, the domain currently resolves to 23.222.81.16, hosted on AS16625 (Akamai Technologies, Inc.) in Germany. The SSL certificate is issued by GoDaddy.com, Inc., which may lend an appearance of legitimacy to the operation. Analysis indicates the site returns an HTTP 200 status, suggesting it is fully operational, and employs technologies including Node.js, Envoy, Express, and HSTS, alongside Akamai content delivery. The domain appears on one security blocklist and is flagged by a single vendor on VirusTotal, though this limited detection does not rule out malicious intent. Nameservers include ns1.afternic.com and ns2.afternic.com, with an additional verification subdomain that may be used for domain control validation. The page title matches the domain name, and no further content analysis has been conducted to confirm specific lures or user interaction flows. Defenders should treat this domain as high-risk due to its active impersonation of a major brand, use of legitimate-looking SSL certificates, and hosting on a reputable CDN. The combination of GoDaddy-issued SSL and Akamai hosting could bypass superficial checks, making manual inspection or automated blocking advisable. Given the domain's age and continued activity, it may be part of a long-running campaign. No evidence suggests takedown efforts have succeeded as of July 12, 2026. Organizations should monitor for connections to this IP or domain, particularly in contexts involving financial transactions or credential submission.