simpleswap-cryptocurrency-exchange[.]com

The domain simpleswap-cryptocurrency-exchange.com was registered on October 10, 2025 through NiceNIC International Group Co., Limited and is currently listed as offline. Infrastructure analysis shows the domain resolves to 172.67.180.83, an IP address owned by Cloudflare, Inc. (AS13335) and located in the United States. The authoritative nameservers are asa.ns.cloudflare.com and patryk.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services. The site presented a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating that TLS termination was performed by Cloudflare’s edge nodes.

Detected front‑end technologies include jQuery, Cloudflare Browser Insights, and HTTP/3, all typical of a modern web stack but offering no indication of malicious code. The page title returned by the server is "SimpleSwap: Instant Cryptocurrency Exchange | 900+ Coins, No Registration," which mirrors the branding of a legitimate cryptocurrency exchange and supports the classification of the domain as a crypto‑related brand impersonation. Reputation scoring from Gridinsoft is 0/100, and the domain appears on a single security blocklist, with PhishDestroy explicitly blocking it. VirusTotal analysis recorded two detections out of ninety‑five scanning engines, reinforcing the suspicion of malicious intent.

The threat profile is identified as a crypto scam that impersonates the SimpleSwap brand across multiple channels. While the site is offline, the combination of a brand‑matching title, low trust score, partial VirusTotal detections, and inclusion on a phishing blocklist provides concrete evidence that the domain has been used for fraudulent purposes. Defenders should continue to block the domain at perimeter defenses, monitor for any re‑hosting attempts on other Cloudflare‑protected IPs, and add the domain to internal threat intelligence feeds.