tronnokyc[.]org

This domain, tronnokyc.org, is flagged as a generic_phishing site targeting cryptocurrency users under the guise of a TRX swap service. The page title, "Tron No KYC — Swap TRX Instantly Without Registration | TronNoKYC.org," suggests a fraudulent platform offering instant TRX swaps without identity verification, a common tactic to lure victims into draining wallets or disclosing private keys. No known drainer kit signatures have been confirmed, but the domain mimics legitimate no-KYC swap services to exploit user trust in decentralized finance (DeFi) platforms.

Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 0/95, indicating no antivirus engines currently flag the domain as malicious. The domain was registered on March 02, 2026, through July Name Limited, a registrar frequently associated with low-reputation domains. It resolves to the IP address 154.219.137.113, hosted in Hong Kong under AS134548 (DXTL Tseung Kwan O Service). The SSL certificate is issued by TrustAsia Technologies, Inc. via LiteSSL RSA CA 2025, providing a false sense of security. As of the latest data, the domain appears on 1 security blocklist and is blocked by PhishDestroy, though Google Safe Browsing (GSB) has not yet listed it.

The domain remains active, with no takedown or sinkholing observed. Response actions by security vendors are limited, as evidenced by the 0/95 VirusTotal score and single blocklist entry. The remaining risk is elevated due to the domain’s continued operation, lack of widespread detection, and targeting of cryptocurrency users. Users are advised to avoid interacting with the domain, verify swap services through official channels, and monitor wallet addresses for unauthorized transactions. Security teams should update blocklists to include this domain and its associated IP, while monitoring for related infrastructure or similar phishing campaigns impersonating no-KYC crypto services.