usdt-trc20-change[.]exchange

usdt-trc20-change.exchange was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to 104.21.91.7, an IP address owned by Cloudflare, Inc. (AS13335) and located in the United States. Both authoritative name servers are Cloudflare‑managed (samara.ns.cloudflare.com, milan.ns.cloudflare.com), indicating the site relies on Cloudflare’s CDN and security services. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS handshake. An HTTP 200 response is returned for the root URL, and the page title observed is “USDT TRC20 No KYC Change – Anonymous Tether Exchange Without Registration”, classifying the operation as a “Fake Exchange” according to the supplied intelligence.

Threat intelligence shows that four of ninety‑three VirusTotal scanners flagged the domain, suggesting that a minority of AV engines have identified malicious behavior. The domain appears on a single external blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, further corroborating its malicious reputation. Detected technologies include Cloudflare Browser Insights, the Cloudflare edge platform, and HTTP/3 support, all of which are typical for infrastructure used by phishing or scam sites. The available evidence confirms that the domain is being used to lure victims into a fraudulent cryptocurrency exchange that claims to allow USDT TRC20 withdrawals without KYC.

No additional content analysis is available; therefore the exact phishing mechanics, credential collection forms, or payload delivery methods remain unknown. Defensive operators should treat the domain as high‑risk. Immediate mitigation steps include adding the domain to network‑level deny lists, enforcing DNS sinkholing where possible, and ensuring that web filtering solutions block the associated IP address and Cloudflare‑hosted hostnames.