trxon[.]co

PhishDestroy has identified trxon.co as a malicious domain masquerading as a legitimate TRX/USDT swap interface, a classic crypto phishing tactic designed to harvest wallet credentials and private keys. The site's page title, "TRX/USDT Swap Interface," is a direct lure for cryptocurrency traders seeking to exchange TRON-based assets. This domain was registered through DYNADOT LLC on May 17, 2026, and despite being taken offline, it poses an ongoing risk due to its presence in multiple threat intelligence feeds.

Technical analysis reveals that trxon.co resolves to IP address 188.114.96.3 and uses an SSL certificate issued by Let's Encrypt (E7), which can lend a false sense of legitimacy. While VirusTotal reports 0 out of 95 security vendors flagging the domain, it has already appeared on 3 security blocklists and is referenced in 4 AlienVault OTX threat intelligence pulses. This discrepancy underscores how phishing sites can evade detection by traditional antivirus engines while being tracked by community-driven platforms.

Users who have visited trxon.co should immediately assume their credentials are compromised. PhishDestroy strongly advises changing passwords for any accounts used on the site, enabling two-factor authentication, and monitoring cryptocurrency wallets for unauthorized transactions. Even though the domain is currently offline, similar variants may reappear, so users should always verify swap interfaces through official channels and use PhishDestroy's domain checker before interacting with any crypto-related site.