# PhishDestroy threat dossier — biswap.biz
================================================================

Fetched:   2026-05-01 23:56:18 UTC
Canonical: https://phishdestroy.io/domain/biswap.biz/

## VERDICT
----------------------------------------------------------------
STATUS STALE — last probed 31 days ago, treat as ACTIVE until re-verified
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)
Scam classification: cryptocurrency
Targeted brand: biswap (and: facebook, telegram, tiktok, twitter)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      3/95 security vendors flagged this domain
  Flagging vendors: ADMINUSLabs, alphaMountain.ai, Fortinet
Public blocklists: listed on 3 independent blocklists
Victim re-reports (public form): 1

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      18.166.147.170 (HK, Hong Kong)
ASN:             ASAS16509 AMAZON-02, US
Hosting org:     AS16509 Amazon.com, Inc.
Registrar:       GoDaddy.com, LLC
Nameservers:     ns31.domaincontrol.com, ns32.domaincontrol.com
Registered:      2020-09-19
Page title:      Biswap | Crypto Exchange | Cryptocurrency Exchange | DEX | Decentralized Exchange | Open source

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority - G2
Expires:    2026-10-22
Status:     INVALID chain
Fingerprint: dbab032f6342ed5734d0fa5f968f4b01cdcb4ce9d8d1306d04cbbaac9860e179

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2020-09-19 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-02-25 02:39:27 UTC (by PhishDestroy tracker)
First reported:    2025-08-10 02:12:57 UTC (abuse notice filed)
Last verified:     2026-03-31 00:43:03 UTC (STALE — 31 days ago, re-verify)
Flagged dead:      2026-03-15 18:06:31 UTC (NOT RE-VERIFIED IN 31 DAYS — treat as unconfirmed)
Current status:    UNCONFIRMED (our live-probe is 31 days stale)

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019891c0-457c-71b5-ac7e-67cc5cc8911f/
Wayback Machine:  https://web.archive.org/web/*/biswap.biz
crt.sh CT logs:   https://crt.sh/?q=%25.biswap.biz
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=biswap.biz
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/biswap.biz
URLhaus:          https://urlhaus.abuse.ch/host/biswap.biz/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-03-19 05:29:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

PhishDestroy identifies biswap.biz as a brand impersonation threat targeting users of the Biswap cryptocurrency exchange. This domain attempts to deceive visitors by mimicking the Biswap brand, which could lead to credential theft or other malicious activity. Such impersonation matters because it undermines user trust and can result in financial loss.

The domain biswap.biz was created on September 19, 2020, and is currently offline. It registered through GoDaddy.com, LLC and resolved to IP 18.166.147.170 before takedown. The site appeared on three security blocklists and scored poorly on trust metrics, including a Gridinsoft trust score of 0/100 and a Scamadviser score of 41/100. VirusTotal flagged it by 3 out of 95 security vendors. Its low PageSpeed score suggests a hastily deployed phishing page designed to quickly capture user data.

Users are advised to avoid visiting biswap.biz and never submit personal or login information on this site. To stay safe, always verify URLs carefully and access the official Biswap platform through trusted channels. If you suspect you have interacted with this or similar phishing domains, promptly update your credentials and monitor your accounts for suspicious activity.

[Updates since narrative was generated:]
  - VirusTotal detections: now 3/95 (narrative was written when count was lower)

## EVIDENCE HASHES
----------------------------------------------------------------
Favicon SHA-256:       4a4dbc62fa335e411b94a532be091c58c0c0c4fa731339f11722577d3cf6443b
TLS cert SHA-256:      dbab032f6342ed5734d0fa5f968f4b01cdcb4ce9d8d1306d04cbbaac9860e179

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (volunteer takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/biswap.biz/
JSON API:          https://api.destroy.tools/v1/check?domain=biswap.biz
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: volunteer-driven open-source threat-intelligence platform.
Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io