exchange[.]swap-trx[.]workers[.]dev

The domain exchange.swap-trx.workers.dev is a confirmed phishing site engaged in brand impersonation targeting the cryptocurrency platform TRON. It presents itself as a legitimate USDT to TRX swap and TRON energy rental service but is designed to deceive users into transferring cryptocurrency under false pretenses. This domain is classified as a cryptocurrency scam and is currently taken offline, though it previously posed an elevated risk to users searching for TRON-related services.

Technical analysis reveals that exchange.swap-trx.workers.dev was flagged by 3 of 95 security vendors on VirusTotal, including ADMINUSLabs, G-Data, and Sophos. It appears on 1 security blocklist, specifically PhishDestroy, and was registered through Cloudflare, Inc. on February 21, 2026. The domain resolves to the IP address 104.21.75.216, hosted by Cloudflare in the US (AS13335), and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'USDT to TRX Swap & TRON Energy Rental | Fast, Secure, Reliable,' and the site employed technologies such as HSTS, Cloudflare, and HTTP/3. Gridinsoft assigned it a trust score of 0/100, and the current HTTP status is 403.

Users who interacted with exchange.swap-trx.workers.dev should immediately revoke any token approvals granted to the site and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized transactions and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (TRON) to assist in takedown efforts.