trx-exchange[.]cfd

The domain trx-exchange.cfd was registered on February 21, 2026 through Dynadot LLC and resolves to the IP address 172.67.74.115, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare nameservers ophelia.ns.cloudflare.com and stanley.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate. HTTP requests return a 403 status code, and the observed page title reads "Liquidswap – the 1st DEX on Aptos," indicating an attempt to impersonate the Aptos brand. The threat is classified as a fake exchange targeting Aptos users, with a high risk rating and an active status. Infrastructure analysis shows the site is protected by Cloudflare and supports HTTP/3, while the Gridinsoft trust score is 0/100. The domain appears on one security blocklist and has been blocked by PhishDestroy; VirusTotal reports three detections out of ninety‑three scanning engines. Current intelligence does not reveal additional page content beyond the title, so the full scope of the deception remains unconfirmed. Defenders should continue to block the domain at perimeter controls, add it to internal blacklists, and monitor for any related indicators such as the resolving IP or associated Cloudflare infrastructure.