Is tron-exchange.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as "TRON Exchange", a decentralized exchange interface for swapping TRC20 tokens on the TRON network. Visitors see a swap terminal, liquidity pools, TRX staking, a referral programme and a wallet-connection prompt. The headline claims are "fastest, cheapest" trading, sub-cent fees, finality in under three seconds, more than 2,000 supported tokens, and "$7.4B+" in total volume. Its apparent business model is protocol swap fees of 0.1% on standard pairs and 0.01% on stablecoin pairs. These fees are said to be split between liquidity providers and a protocol treasury, with additional referral and staking incentives.

Scam/Impersonation Risk

The evidence shows hard contradictions that call for a clearly cautionary stance. Several well-known security vendors independently flag the domain as malicious, and a substantial number of other engines mark it malicious or suspicious. This amounts to a confirmed blacklist condition, and it outweighs every stabilising factor on the site. No brand impersonation and no conflicting legal identities were detected. The risk therefore rests on the external threat detections and on the nature of the offering. The homepage asks visitors to connect a wallet and sign transactions, a high-stakes action that exposes a user's funds. Yet it offers no named audit firm or audit report, no contract addresses, no operator identity and no contact channel. The reassurances it does give are unsupported assertions: "We never have access to your funds", non-custodial operation, audits and a bug bounty. The "$7.4B+" volume figure and the "2,000+ TRC20 tokens" counter cannot be checked against anything on the page, so they function as unverifiable social proof. The sandbox also recorded the page sending POST and XHR traffic to external destinations outside the expected set, which fits a pattern of third-party data flows that is not explained anywhere on the site. The page also names a long list of wallet brands, including Ledger, MetaMask, Trust Wallet and Binance Web3 Wallet. This lends borrowed credibility but is not evidence of any partnership. Evidence:

• Homepage: the stat counters ("$7.4B+ Total Volume", "2,000+ TRC20 Tokens", "<3s Finality") and the claims of audits and a bug bounty carry no references or links.
• Homepage FAQ: it states "We never have access to your funds" and that wallet connection is safe, but no contract addresses or audit documents back this up.
• Domain provenance: the domain was registered in 2026 (about 83 days old, ~0.23 years), and the web archive holds only 1 snapshot (first and last seen in 2026, 1 year tracked), so there is no established track record.
• Sandbox behaviour: 3 of 3 runs showed a wallet-signing flow, with up to 85.7% external request share and 3 non-whitelisted POST destinations.

Regulatory Verification Notes

The site presents no legal, terms, about or licensing page that names an operating entity, a jurisdiction, a licence or a registration number. A DeFi product that handles customer-signed swaps, liquidity deposits and staking is a financial-services-adjacent activity, and the site makes no claim of regulatory authorisation. No third-party broker or regulator record matches the site, so there is no reputational or licensing signal either way. The abuse reports recorded against the hosting address come from a shared provider environment. They are a soft contextual signal about that address, not a finding about the operator, and the verdict does not depend on them. Without an identifiable operator, a user has no named party to hold accountable for custody, treasury control or dispute handling. Evidence:

• Homepage and FAQ: there is no operator name, registered address, licence or complaint route, and the treasury receiving the protocol fee share is not identified.
• Domain registration: it went through the registrar Atak Domain under a generic "Domain Administrator" registrant label, which names no real-world entity.
• Hosting and encryption: the site is served from AS59692 (IQWEB – IQWeb FZ-LLC, AE, 186.2.175.35). The TLS certificate is issued by YR2 at DV level, valid to 2027-01-18. A DV certificate only proves control of the domain and says nothing about the operator.
• Hosting-address reputation: 5 abuse reports exist for the shared hosting IP, attributed to shared infrastructure and not discounted.

What to Verify Next

Verification should start with independently sourced identity and security evidence. It should not rely on anything the site says about itself. First, the operator and any claimed audit should be traced through the audit firm's own channels, not through links or logos on this site. Second, any smart-contract address the site would use should be matched against an independent blockchain explorer and a reputable DeFi registry before any approval or signature is considered. Third, the official project name, social presence and support channels should be confirmed from a source reached independently, such as an established directory or a documented announcement, to check whether this domain is the legitimate frontend of any known TRON exchange. Fourth, the current threat-listing status should be rechecked with the security vendors that flagged the domain. Evidence:

• Homepage: the claimed audits, bug bounty and non-custodial design carry no named auditor, report or contract reference to check.
• Homepage swap terminal: wallet signing is required for swaps, pools and staking, so contract identity must be established before any signature.
• Homepage: no contact channel or social profile is published to confirm independently.

Summary Verdict

The domain is a very recent, anonymous crypto-exchange frontend that third-party security vendors currently flag as malicious. It asks visitors to sign wallet transactions on the strength of claims it cannot substantiate. The evidence supports a high-risk assessment for any sensitive or financial interaction. Its polished interface and valid encryption do not offset this.

Infrastructure Integrity

The site resolves to a single address at a shared data-centre hosting provider in the United Arab Emirates. No CDN or WAF fronts it, so the origin server is directly exposed. The young domain, its sparse DNS footprint and a mismatch between hosting geography and registry add to the infrastructure risk, though these are unconfirmed heuristics. Nothing in the setup mitigates the external threat detections. The valid certificate and stable HTTP responses show only that the site works technically.

Closing Assessment

Treat the site as unsafe for wallet connection, token approvals, deposits, staking, credentials or any financial activity. Read-only viewing, if needed at all, should be done from an isolated environment without a wallet extension. Anyone who has already connected a wallet or signed a transaction here should revoke token approvals promptly and move remaining assets to a fresh wallet.

Signals weighed against the site

• AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.