tronswap[.]app

Analysis indicates that the domain tronswap.app is actively engaged in brand impersonation targeting Bitget, a known cryptocurrency exchange. The domain was registered through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, which is associated with Cloudflare's network (AS13335) and geolocated in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (april.ns.cloudflare.com and jake.ns.cloudflare.com), alongside technologies such as Unpkg, jsDelivr, Cloudflare Browser Insights, Axios, and HTTP/3, which are consistent with modern web applications but also commonly leveraged in phishing operations to evade detection. The page title, 'TRON SWAP — Tron DEX at tronswap.app,' suggests an attempt to mimic a decentralized exchange (DEX) platform, aligning with the reported scam type of a crypto scam. While the exact content and functionality of the site remain unanalyzed, the domain is flagged by seven of ninety-five security vendors on VirusTotal, indicating a moderate level of detection. Additionally, it appears on three security blocklists and is actively blocked by at least three anti-phishing tools. The Gridinsoft trust score of 0/100 further corroborates the high-risk classification. Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels. Given its active status and association with Cloudflare's infrastructure, monitoring for shifts in IP resolution or nameserver changes may be necessary to preempt evasion attempts. No registration date or historical context is available to assess the longevity of this campaign, but the current indicators warrant immediate mitigation.