# PhishDestroy domain threat record: simpleswap-i.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/simpleswap-i.com/
Machine-readable companion: https://phishdestroy.io/domain/simpleswap-i.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 03:06:26 UTC
- Last availability or vendor check: 2026-10-23 11:16:16 UTC
- Stored record updated: 2026-10-23 18:22:35 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: arbitrum

## Stored infrastructure

- Observed IP address: 185.92.183.22
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Registrar country in stored WHOIS data: UA
- Registration date (registry RDAP, simpleswap-i.com): 2026-08-09 23:42:46 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a166b8-059e-726f-a162-c142c95d0ef5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/simpleswap-i.com
- Certificate Transparency search: https://crt.sh/?q=%25.simpleswap-i.com
- Web Archive lookup: https://web.archive.org/web/*/https://simpleswap-i.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed simpleswap-i.com as a suspicious domain based on automated analysis. The site presented the page title “Simpleswap — Instant Crypto Exchange”. The domain was first seen by PhishDestroy on 2026-10-23. Intake notes cite a VirusTotal redirector detection pointing to simpleswap.com as the trigger for the listing.

How the scam works
Domains that mimic legitimate crypto services often use deceptive branding and redirects to lure users into entering credentials or approving wallet connections. While the current evidence does not confirm a specific payload, such pages can be used to harvest login details, capture session tokens, or trick users into authorizing malicious transactions. The general risk is credential or wallet‑approval phishing.

Evidence
VirusTotal reported 7 malicious and 2 suspicious detections from 9 total vendors on 2026-10-22, including BitDefender, Kaspersky and Sophos. Google Safe Browsing showed no flag on 2026-10-23. urlscan.io recorded a client‑side 307 redirect to simpleswap.com and an engine‑derived malicious score of 96, though its overall verdict was non‑malicious. External blocklists MetaMask and SEAL flagged the domain. PhishDestroy’s internal blocklist also contains the domain. OTX listed three pulses mentioning the domain. Cloudflare Radar later returned a 404, but this does not prove the site is permanently offline.

Infrastructure
The domain was registered on 2026-08-09 through Hosting Concepts B.V. d/b/a Registrar.eu, with creation recorded on 2026-08-10. The recorded DNS entry listed 185.92.183.22, which was associated with AS56971 CGI GLOBAL LIMITED in Latvia. The TLS certificate (Let's Encrypt / YR1) was valid from 2026-08-10 to 2026-11-08. Open ports included 22, 80 and 443. Nameservers were a.dnspod.com, b.dnspod.com and c.dnspod.com.

What to do
Do not enter any crypto‑exchange credentials or approve wallet connections on this site. If credentials were submitted, change them immediately and review associated accounts for unauthorized activity. Security teams should block simpleswap-i.com in network filters and monitor logs for any connections to that domain. Report any suspicious interactions to PhishDestroy for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a166b8-059e-726f-a162-c142c95d0ef5/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8ead5122-3722-4f97-9ecb-833f7881ed7c
URLQuery report: https://urlquery.net/report/f37efa16-44af-434a-8f6d-8a0825e0e3b2
Stored capture screenshot: https://i.ibb.co/RTsDVQK3/a63b07779f9e.png
Cloudflare Radar screenshot (2026-10-23T03:43:05Z): https://screenshots.phishdestroy.io/cf/8ead5122-3722-4f97-9ecb-833f7881ed7c.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/f37efa16-44af-434a-8f6d-8a0825e0e3b2.png
URLScan screenshot (2026-10-22T09:01:40Z): https://screenshots.phishdestroy.io/us/01a162d8-1fb6-758d-96c2-2ae53a80192f.png
URLScan capture report: https://urlscan.io/result/01a162d8-1fb6-758d-96c2-2ae53a80192f/
URLScan screenshot (2026-10-22T15:34:06Z): https://screenshots.phishdestroy.io/us/01a1643f-65d1-7339-8579-89674ba4b2f2.png
URLScan capture report: https://urlscan.io/result/01a1643f-65d1-7339-8579-89674ba4b2f2/
URLScan screenshot (2026-10-22T19:30:06Z): https://screenshots.phishdestroy.io/us/01a16517-7b13-7699-ac38-00cd5ead35da.png
URLScan capture report: https://urlscan.io/result/01a16517-7b13-7699-ac38-00cd5ead35da/
URLScan screenshot (2026-10-23T00:44:07Z): https://screenshots.phishdestroy.io/us/01a16636-d77e-75fb-ae55-a89645498a0a.png
URLScan capture report: https://urlscan.io/result/01a16636-d77e-75fb-ae55-a89645498a0a/
URLScan screenshot (2026-10-23T01:39:31Z): https://screenshots.phishdestroy.io/us/01a16669-b15a-70ca-a193-15531ec1e003.png
URLScan capture report: https://urlscan.io/result/01a16669-b15a-70ca-a193-15531ec1e003/
URLScan screenshot (2026-10-23T01:47:21Z): https://screenshots.phishdestroy.io/us/01a16670-de9c-777b-964a-15ff69f81878.png
URLScan capture report: https://urlscan.io/result/01a16670-de9c-777b-964a-15ff69f81878/
VirusTotal report: https://www.virustotal.com/gui/domain/simpleswap-i.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=simpleswap-i.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 03:46:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/RTsDVQK3/a63b07779f9e.png
  Captured: 2026-10-23 03:06:26 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a166b8-059e-726f-a162-c142c95d0ef5.png
  Captured: 2026-10-23 03:06:26 UTC
  Source report: https://urlscan.io/result/01a166b8-059e-726f-a162-c142c95d0ef5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8ead5122-3722-4f97-9ecb-833f7881ed7c.png
  Captured: 2026-10-23 03:43:05 UTC
  Source report: https://radar.cloudflare.com/scan/8ead5122-3722-4f97-9ecb-833f7881ed7c
  SHA-256: d771a95c0eeed6f3f816473ac1a6f5bce827d6e828fc95fb8b26eb07cb3a7757
- URLQuery: https://screenshots.phishdestroy.io/uq/f37efa16-44af-434a-8f6d-8a0825e0e3b2.png
  Source report: https://urlquery.net/report/f37efa16-44af-434a-8f6d-8a0825e0e3b2
  SHA-256: a7967410c550cc7f510c218cc8cbf80b59e66563f6d1a2633183810a1aefa24a
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a162d8-1fb6-758d-96c2-2ae53a80192f.png
  Captured: 2026-10-22 09:01:40 UTC
  Source report: https://urlscan.io/result/01a162d8-1fb6-758d-96c2-2ae53a80192f/
  SHA-256: 5af6dbce76a9f1714d7fc27cf07a4f51887d6d63f65530a7727e5f364ec1244a
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1643f-65d1-7339-8579-89674ba4b2f2.png
  Captured: 2026-10-22 15:34:06 UTC
  Source report: https://urlscan.io/result/01a1643f-65d1-7339-8579-89674ba4b2f2/
  SHA-256: 5af6dbce76a9f1714d7fc27cf07a4f51887d6d63f65530a7727e5f364ec1244a
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16517-7b13-7699-ac38-00cd5ead35da.png
  Captured: 2026-10-22 19:30:06 UTC
  Source report: https://urlscan.io/result/01a16517-7b13-7699-ac38-00cd5ead35da/
  SHA-256: 5af6dbce76a9f1714d7fc27cf07a4f51887d6d63f65530a7727e5f364ec1244a
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16636-d77e-75fb-ae55-a89645498a0a.png
  Captured: 2026-10-23 00:44:07 UTC
  Source report: https://urlscan.io/result/01a16636-d77e-75fb-ae55-a89645498a0a/
  SHA-256: 1684fb4a2e8454ae6280c2eb1a9177436b0314648ee0477b8a3a997dcc248e69
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16669-b15a-70ca-a193-15531ec1e003.png
  Captured: 2026-10-23 01:39:31 UTC
  Source report: https://urlscan.io/result/01a16669-b15a-70ca-a193-15531ec1e003/
  SHA-256: 88d654173262c86b0d392230026e02ba0ec6ce7449dd872ddfced7db92c51b2c
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16670-de9c-777b-964a-15ff69f81878.png
  Captured: 2026-10-23 01:47:21 UTC
  Source report: https://urlscan.io/result/01a16670-de9c-777b-964a-15ff69f81878/
  SHA-256: 8e335e47e6b65ed16f84410dca45701167b74766a8d5725a8a35b188651ccc98

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T03:26:02Z",
        "uuid": "01a166b8-059e-726f-a162-c142c95d0ef5",
        "scanned_at": "2026-10-23T03:05:10Z",
        "final_url": "https://simpleswap-i.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://simpleswap-i.com/",
                "from": "http://simpleswap-i.com/",
                "status": 307
            }
        ],
        "ip": "185.92.183.22",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "209.85.144.94",
            "172.217.222.95",
            "185.92.183.22"
        ],
        "asns": [
            "15169",
            "56971"
        ],
        "countries": [
            "US",
            "LV"
        ],
        "link_domains": [
            "simpleswap.com",
            "en.wikipedia.org",
            "ethereum.foundation"
        ],
        "doc_hash": "a402659fb1057c51c79fcc9b463b4b938ff1765a691e38bbff94815904bc0c51",
        "script_hashes": [
            "a9798b03737fa46b626d4eed34a8e54c54a7158b6a6c9227594479bf907d350d"
        ],
        "tls": {
            "san": [
                "simpleswap-i.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "simpleswap-i.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-08T04:24:23Z",
            "valid_from": "2026-08-10T04:24:24Z"
        },
        "domain_age_days": 74,
        "apex_age_days": 74,
        "tls_age_days": 73,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T03:45:35Z",
        "uuid": "8ead5122-3722-4f97-9ecb-833f7881ed7c",
        "scanned_at": "2026-10-23T03:43:05Z",
        "final_url": "https://simpleswap-i.com/",
        "status": 404,
        "history": [
            {
                "url": "https://simpleswap-i.com/",
                "status": 404
            }
        ],
        "dom_hash": "923b210ca197f9a86c707c80d096dca8d1efbfa96bb5afff63ff4367fb7fd993",
        "doc_hash": "38a6c8c71d600c7e49997900243e808f032bfc05842925820b24688d5690d1d9",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "simpleswap-i.com",
                "type": "A",
                "value": "185.92.183.22"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.92.183.22",
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-08-09T23:42:46Z",
            "updated": "2026-08-09T23:42:48Z",
            "expires": "2027-08-09T23:42:46Z",
            "nameservers": [
                "a.dnspod.com",
                "c.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T03:42:33Z",
        "analysis_at": "2026-10-22T13:57:32Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 7,
            "suspicious": 2,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Sophos": "malware",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Kaspersky": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "malicious"
        },
        "reputation": 0,
        "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
        "created": "2026-08-09T23:42:46Z",
        "expires": "2027-08-09T23:42:46Z",
        "updated": "2026-08-10T01:42:49Z",
        "first_seen": "2026-08-10T00:04:41Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "194.238.57.99"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            }
        ],
        "dns_at": "2026-10-22T13:58:09Z",
        "jarm": "3fd3fd0003fd3fd00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356",
        "cert": {
            "san": [
                "simpleswap-i.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "51da08ac8c216ad42789fdb0a880030c4f5",
            "sha256": "7b2b8fbbde79f41337f45487626de729d6a68ca1a50b57d7f6b666bf16570582",
            "subject": "simpleswap-i.com",
            "valid_to": "2026-11-08T04:24:23Z",
            "valid_from": "2026-08-10T04:24:24Z"
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "http://www.openprovider.com",
            "created": "2026-08-09T23:42:46Z",
            "updated": "2026-08-09T23:42:48Z",
            "expires": "2027-08-09T23:42:46Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a.dnspod.com",
                "c.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-09T23:42:46Z",
                "registration": "2026-08-09T23:42:46Z",
                "registrar expiration": "2027-08-09T23:42:46Z",
                "last update of RDAP database": "2026-10-17T18:28:00Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T03:45:49Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "simpleswap-i.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T03:07:41Z",
            "first": "2026-10-23T03:07:41Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1004
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://simpleswap-i.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 27
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "43.134.249.75",
                    "host": "c.dnspod.com"
                },
                {
                    "ip": "101.227.168.75",
                    "host": "a.dnspod.com"
                },
                {
                    "ip": "43.161.3.75",
                    "host": "b.dnspod.com"
                }
            ],
            "zone": "simpleswap-i.com"
        },
        "location": {
            "ip": "185.92.183.22",
            "asn": "56971",
            "org": "CGI GLOBAL LIMITED",
            "city": "Riga",
            "country": "LV"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "simpleswap-i.com"
        },
        "dns": {
            "A": [
                "185.92.183.22"
            ],
            "NS": [
                "a.dnspod.com",
                "c.dnspod.com",
                "b.dnspod.com"
            ],
            "SOA": "{\"nsname\": \"a.dnspod.com\", \"hostmaster\": \"domainadmin.dnspod.com\", \"serial\": 1792710738, \"refresh\": 3600, \"retry\": 180, \"expire\": 1209600, \"minttl\": 180}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.92.183.22",
            "family": 4
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.simpleswap-i.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Nginx"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-08-09T23:42:46Z",
            "updated": "2026-08-09T23:42:48Z",
            "expires": "2027-08-09T23:42:46Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "a.dnspod.com",
                "c.dnspod.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```