# PhishDestroy threat dossier — garden-finance-swap.com ================================================================ Fetched: 2026-07-22 23:13:22 UTC Canonical: https://phishdestroy.io/domain/garden-finance-swap.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Scam Targeted brand: Yearn ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Gridinsoft Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 45.9.117.57 (NL, Amsterdam) ASN: ASAS203273 NetCraftersOU NetCrafters OU, EE Hosting org: AS203273 NetCrafters OU Registrar: UnstoppableUS2 LLC Nameservers: ns1.unstoppabledomains.com, ns2.unstoppabledomains.com Registered: 2026-06-29 Expires: 2027-06-29 Page title: Garden Finance Swap — Fast Cross-Chain Bitcoin Bridge | garden-finance-swap.com HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-27 Status: INVALID chain Fingerprint: 75d9c1b0e61056b7d96a10e61cc9782e47ab073b2fa86a50e9b2f9b54ca96913 Subject Alternative Names (related infrastructure — often same operator): - www.garden-finance-swap.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-29 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-08 14:37:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-23 00:20:37 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f41ba-0f67-70a0-9d71-30fb81366947/ URLQuery: https://urlquery.net/report/a1038229-c44c-48aa-9c14-4fa4eb4e5706 Wayback Machine: https://web.archive.org/web/*/garden-finance-swap.com crt.sh CT logs: https://crt.sh/?q=%25.garden-finance-swap.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=garden-finance-swap.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/garden-finance-swap.com URLhaus: https://urlhaus.abuse.ch/host/garden-finance-swap.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-14 14:40:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] garden-finance-swap.com: Crypto Brand Impersonation Scam Analysis of garden-finance-swap.com shows a newly registered domain (creation date June 29, 2026) that impersonates the Yearn brand and is classified as a crypto scam. The site resolves to IP 45.9.117.57, which maps to the Netherlands (AS203273 NetCrafters OU). Infrastructure fingerprints reveal an Ubuntu operating system behind an Nginx web server and a Let’s Encrypt certificate (YR2). Registration was performed through UnstoppableUS2 LLC and the domain uses the nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. The page title advertises a "Fast Cross-Chain Bitcoin Bridge," confirming a financial lure. Threat intelligence indicates the domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, and one of 91 VirusTotal scanners flagged the site. HTTP response code is 200, suggesting the site is actively serving content. While the exact landing page layout has not been examined, the combination of brand impersonation, low trust scoring, and active blocking suggests a high‑risk credential‑stealing or fund‑diversion operation. Defenders should add the domain and its IP to deny lists, monitor DNS queries for similar unstoppabledomains.com patterns, and enforce strict outbound filtering for unknown cross‑chain bridge URLs. Continuous threat‑intel feeds should be consulted for any emerging variants that reuse the same registration or hosting infrastructure. [Updates since narrative was generated:] - WHOIS creation date: 2026-06-29 ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 4e7f28f4b223c186000ea2ba43d0ae4a TLS cert SHA-256: 75d9c1b0e61056b7d96a10e61cc9782e47ab073b2fa86a50e9b2f9b54ca96913 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/garden-finance-swap.com/ JSON API: https://api.destroy.tools/v1/check?domain=garden-finance-swap.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,484 domains (57,762 alive under monitoring, 129,097 confirmed takedowns/dead). Site: https://phishdestroy.io