# PhishDestroy domain threat record: simpieswap-io.to

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/simpieswap-io.to/
Machine-readable companion: https://phishdestroy.io/domain/simpieswap-io.to/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 13:57:19 UTC
- Last availability or vendor check: 2026-10-21 01:16:17 UTC
- Stored record updated: 2026-10-22 14:24:14 UTC
- VirusTotal detections in the stored snapshot: 1/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Registrar in stored WHOIS data: Government of Kingdom of Tonga
- Registration date (registry RDAP, simpieswap-io.to): 2026-08-13 18:57:17 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/simpieswap-io.to
- Certificate Transparency search: https://crt.sh/?q=%25.simpieswap-io.to
- Web Archive lookup: https://web.archive.org/web/*/https://simpieswap-io.to/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
simpieswap-io.to is an impersonation phishing page. Its name swaps the "l" in SimpleSwap for an "i" and appends "-io", a lookalike built to pass a quick glance in a search result, ad or chat link. It targets people who want to exchange cryptocurrency. PhishDestroy first flagged it on 2026-09-14, and the site has been offline since 2026-09-21. At the last check on 2026-10-19 its DNS was still inactive.

How the scam works
Fake swap services copy the look of the real exchange so that a victim starts a trade without suspicion. The victim may be shown a deposit address controlled by the operators, and anything sent there is gone with no swap in return. Other versions ask the visitor to connect a wallet and sign a transaction or token approval that lets the attacker move funds. Either way the loss is cryptocurrency, sent directly or pulled out through a malicious signature.

Evidence
On VirusTotal, only 1 of 89 engines flags the domain, SOCRadar, as of 2026-09-23. That weak score is offset by stronger signals from crypto-focused sources. MetaMask and SEAL both list the domain alongside PhishDestroy, Spamhaus classifies it as DBL_PHISH, and it appears in 3 AlienVault OTX threat pulses. This mix is common for short-lived crypto phishing: wallet and security-community blocklists catch it well before general antivirus engines do.

Infrastructure
The domain was registered on 2026-08-13, about a month before PhishDestroy detected it. It was down a week after detection, which fits a disposable domain meant for a short campaign. It sits under the .to country-code extension, administered through the Government of Kingdom of Tonga registry.

What to do
If you sent funds to an address shown on this site, record the transaction hash and report it to the exchange you sent from and to SEAL. On-chain transfers cannot be reversed, but quick reports can help trace or freeze funds downstream. If you connected a wallet or signed anything, revoke token approvals with a trusted approval-checker and move the remaining assets to a fresh wallet if you shared a seed phrase. Defenders should block the domain and watch for new SimpleSwap lookalikes that reuse the "-io" pattern on other extensions.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/simpieswap-io.to
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=simpieswap-io.to
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:47 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:26Z",
        "uuid": "3847d225-78b0-483a-acad-03c480e9d7a1",
        "scanned_at": "2026-09-22T15:19:58Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:32:03Z",
        "analysis_at": "2026-09-25T06:43:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "registrar": "Government of Kingdom of Tonga",
        "created": "2026-08-13T18:57:17Z",
        "expires": "2028-08-13T18:57:17Z",
        "updated": "2026-09-10T16:57:22Z",
        "first_seen": "2026-09-10T19:09:50Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "arvind.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "arvind.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "nena.ns.cloudflare.com"
            },
            {
                "ttl": 120,
                "type": "A",
                "value": "144.31.40.224"
            }
        ],
        "dns_at": "2026-09-15T13:40:11Z",
        "jarm": "28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "simpieswap-io.to"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5403513391b21cf2c46b32959017ad6c4c2",
            "sha256": "4ca37ea0161cf40396b3747127be891cee2787ee7f21ce09f3ded31464ccd4fe",
            "subject": "simpieswap-io.to",
            "valid_to": "2026-12-14T10:39:34Z",
            "valid_from": "2026-09-15T10:39:35Z"
        },
        "whois": {
            "registrar": "Government of Kingdom of Tonga",
            "registrar_iana_id": "6763001",
            "registrar_url": "http://tonicregistry.to/",
            "created": "2026-08-13T18:57:17Z",
            "updated": "2026-09-10T16:57:22Z",
            "expires": "2028-08-13T18:57:17Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "arvind.ns.cloudflare.com",
                "nena.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client hold",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2028-08-13T18:57:17Z",
                "last changed": "2026-09-19T04:56:18Z",
                "registration": "2026-08-13T18:57:17Z",
                "last update of RDAP database": "2026-09-25T08:21:22Z"
            }
        }
    }
}
```