trons[.]exchange

Analysis of trons.exchange shows a newly registered domain (created 22 March 2026) that was used to host a counterfeit cryptocurrency exchange front‑end. The site resolved to 172.67.133.28, an IP owned by Cloudflare, Inc. in Canada, and was served through Cloudflare’s DNS (grace.ns.cloudflare.com, hans.ns.cloudflare.com) and its Browser Insights and HTTP/3 stack. No TLS certificate was observed, indicating the service was delivered over plain HTTP, which is atypical for legitimate financial platforms and facilitates man‑in‑the‑middle interception. The page title advertised a “TRON No KYC Exchange — Instant TRX Swap to BTC, XMR, USDT”, matching the known scam type of a fake exchange that promises KYC‑free swaps.

VirusTotal scanned the domain and 6 of 94 security engines flagged it as malicious, while Gridinsoft assigned a trust score of 0 / 100. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED, a provider commonly used for disposable registrations. Current status is offline, but the infrastructure—Cloudflare front‑end and the same IP address—could be re‑used for future campaigns.

Defenders should add 172.67.133.28 to network‑level deny lists, monitor for new domains registered by the same registrar that resolve to Cloudflare IP ranges, and enforce strict URL filtering for any request containing the “trons.exchange” host or the exact page title string. Because the site lacked HTTPS, any residual traffic can be inspected without decryption penalties. Continuous threat‑intel feeds should be consulted for updates on the blocklist presence, and any internal alerts triggered by the 6 VirusTotal detections should be correlated with endpoint telemetry.