tronswapster[.]com

Analysis of the domain tronswapster.com shows a recent registration (20 Nov 2025) and immediate deployment of a cryptocurrency‑focused scam infrastructure. The site resolves to the Cloudflare anycast address 198.18.1.99 and uses Cloudflare’s DNS resolvers keaton.ns.cloudflare.com and lina.ns.cloudflare.com. TLS termination is provided by a Google Trust Services / WE1 certificate, and HTTP/3 is advertised, indicating a modern web stack. Current HTTP response code 521 suggests the origin server is unavailable, a pattern often observed when attackers temporarily hide behind Cloudflare to evade takedown.

Public intelligence flags the domain as a cryptocurrency phishing operation. The page title, "TRONSWAPSTER — Купить TRX за USDT," directly advertises the purchase of TRX using USDT, confirming the intent to lure victims into a crypto transaction scam. The domain appears on a single security blocklist maintained by PhishDestroy, and VirusTotal scanning shows two of ninety‑five security vendors flagging it as malicious, reinforcing the suspicion despite a low detection ratio. Registration was performed through Tucows Domains Inc., a common registrar for disposable or fast‑turnaround domains used in illicit campaigns.

Uncertainties remain regarding the underlying payload or credential‑harvesting mechanism, as the content of the webpage has not been captured in this report. No additional indicators such as malicious scripts, redirects, or phishing forms have been observed, limiting attribution to a purely domain‑level assessment. Defenders should proactively block the domain at DNS and proxy layers, monitor outbound connections to the Cloudflare‑owned IP range for anomalous traffic, and correlate any attempted TRX/USDT transfers with user activity logs. Continuous re‑scanning with multi‑vendor engines is advised to capture evolving detection signatures, and any related indicators should be added to internal threat‑intel feeds to mitigate future exploitation.