# PhishDestroy domain threat record: swapgo.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/swapgo.io/ Machine-readable companion: https://phishdestroy.io/domain/swapgo.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 03:32:04 UTC - Last availability or vendor check: 2026-10-24 23:06:44 UTC - Stored record updated: 2026-10-25 07:34:16 UTC - VirusTotal detections in the stored snapshot: 7/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 104.21.96.61 - Registrar in stored WHOIS data: Porkbun LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, swapgo.io): 2026-03-11 10:43:34 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16bf5-b210-71d4-a1d8-de9593c0f550/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/swapgo.io - Certificate Transparency search: https://crt.sh/?q=%25.swapgo.io - Web Archive lookup: https://web.archive.org/web/*/https://swapgo.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies swapgo.io as an impersonation phishing page. The recorded page title on 2026-10-24 is “SwapGo — Instant Crypto Swap”. The page advertises a legitimate crypto‑swap service, yet PhishDestroy flagged it as impersonation. PhishDestroy first observed the domain on 2026-10-24, when it returned HTTP 200. How the scam works Impersonation phishing creates a replica of a trusted service to trick users into entering login credentials, seed phrases, or approving wallet transactions, which can lead to account takeover or fund loss. Evidence VirusTotal scanned swapgo.io on 2026-10-25 and recorded seven detections from 92 engines, with four vendors marking it malicious and three marking it suspicious. Google Safe Browsing checked on 2026-10-25 and did not flag the site. urlscan captured the site on 2026-10-24; its overall verdict was clean but its engine flagged it malicious with a score of 83. Spamhaus DBL listed the domain as phishing on 2026-10-24. OTX listed four pulses referencing swapgo.io as of 2026-10-25. External blocklists MetaMask and SEAL also list the domain (checked 2026-10-25), and PhishDestroy’s internal blocklist includes it. Infrastructure The domain was registered with Porkbun LLC on 2026-03-11. DNS records observed on 2026-10-24 resolve to Cloudflare network addresses (A 172.67.173.155, 104.21.96.61; AAAA 2606:4700:3033::ac43:ad9b, 2606:4700:3037::6815:603d). The hosting record noted the IP 172.64.80.1 within Cloudflare’s network. TLS was served with a Let’s Encrypt certificate valid from 2026-09-04 to 2026-12-03 for *.swapgo.io and swapgo.io. DNSSEC was not enabled. What to do Do not enter any credentials, seed phrases, or approve wallet connections on swapgo.io; if you have already done so, change the associated passwords immediately. Defenders should block the domain, monitor access logs for requests to this exact address, and update security policies to deny traffic to swapgo.io. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16bf5-b210-71d4-a1d8-de9593c0f550/ Cloudflare Radar report: https://radar.cloudflare.com/scan/aeebad51-a02a-47f0-9a9e-15e268542cbe Stored capture screenshot: https://i.ibb.co/bMJz7vnS/185692728526.png Cloudflare Radar screenshot (2026-10-24T04:03:17Z): https://screenshots.phishdestroy.io/cf/aeebad51-a02a-47f0-9a9e-15e268542cbe.png VirusTotal report: https://www.virustotal.com/gui/domain/swapgo.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=swapgo.io Archived copy: https://web.archive.org/web/20261024033412/https://swapgo.io/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 04:59:38 UTC ## Stored page captures - Primary capture: https://i.ibb.co/bMJz7vnS/185692728526.png Captured: 2026-10-24 03:32:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16bf5-b210-71d4-a1d8-de9593c0f550.png Captured: 2026-10-24 03:32:04 UTC Source report: https://urlscan.io/result/01a16bf5-b210-71d4-a1d8-de9593c0f550/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aeebad51-a02a-47f0-9a9e-15e268542cbe.png Captured: 2026-10-24 04:03:17 UTC Source report: https://radar.cloudflare.com/scan/aeebad51-a02a-47f0-9a9e-15e268542cbe SHA-256: 61763cb1e72274fe801393c9af02095c4e32eaac16db370f73e976c2cede2cd0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T04:03:33Z", "uuid": "01a16bf5-b210-71d4-a1d8-de9593c0f550", "scanned_at": "2026-10-24T03:30:38Z", "final_url": "https://swapgo.io/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://swapgo.io/", "from": "http://swapgo.io/", "status": 307 } ], "ip": "172.64.80.1", "domains": [ "static.cloudflareinsights.com" ], "ips": [ "104.16.80.73", "172.64.80.1" ], "asns": [ "13335" ], "doc_hash": "77178c1cc02f0e644f362b124aa6071551cddbb58b6418efe2fdc34d13ac85ea", "script_hashes": [ "64c474179ee9d03f1198f7ba3f0057c556a3ab4b58b6ab41113b62262f227816", "2c4b99b547f496b113a352f9e2f455f9d38a13c063611ca9b96085176bc78091", "7b340d0e288c3429dbefdab84605bb381509d488c661ce0b8f14ba09bc0dff0c", "59dabf84ff727fee182322792cda888b4909a8c785941615a5da669ad10f5662", "f14d175aa23d43046ac0a0441a6b302b14de4e6d6509435a0c5a4a99247195a9", "aee2d073d2a1157cfe5c98907f90b3967de4c3625f9ffb154bd1979ae2b917b0", "6f159066218aa8120a3c019b6041de651f81b45e0b3a5c232bd3ca008d0915ae", "3e5e428ab41b6e5a0d27ceb51512d9b169f18ec7637a66c82dda998bb874a750", "d35305aec28f8087939ee4010b168ace47a148ebd2c3771222f13b624339037b", "461bc6db524f58479a69fc655766b4412c47313338f28d6af66ec7c5bff27e36" ], "globals": [ "TURBOPACK", "__next_f", "__cfBeacon", "next", "__webpack_hash__" ], "storage_keys": [ "swapgo:last-pair" ], "tls": { "san": [ "*.swapgo.io", "swapgo.io" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "swapgo.io", "protocol": "TLS 1.3", "valid_to": "2026-12-03T14:49:12Z", "valid_from": "2026-09-04T14:49:13Z" }, "domain_age_days": 825, "apex_age_days": 825, "tls_age_days": 49, "tls_valid_days": 89, "requests": 28, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 83, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T04:03:35Z", "uuid": "aeebad51-a02a-47f0-9a9e-15e268542cbe", "scanned_at": "2026-10-24T04:03:17Z", "final_url": "https://swapgo.io/", "status": 200, "history": [ { "url": "https://swapgo.io/", "status": 200 } ], "dom_hash": "60d8a5b4dc41470b7fb171c59d32b69b47c29628a9bdb9a01a6bbb19278abad5", "doc_hash": "cd60afd5429044b8b62d51750230c9074763389bdf376b7a1995f7a9b427ddef", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "swapgo.io", "type": "A", "value": "172.67.173.155" }, { "name": "swapgo.io", "type": "A", "value": "104.21.96.61" }, { "name": "swapgo.io", "type": "AAAA", "value": "2606:4700:3037::6815:603d" }, { "name": "swapgo.io", "type": "AAAA", "value": "2606:4700:3033::ac43:ad9b" } ], "dnssec_valid": false, "ip": "172.67.173.155", "whois": { "registrar": "Porkbun LLC", "created": "2026-03-11T10:43:34Z", "updated": "2026-10-21T03:08:23Z", "expires": "2028-03-11T10:43:34Z", "nameservers": [ "ed.ns.cloudflare.com", "leanna.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T04:56:55Z", "analysis_at": "2026-10-24T23:03:20Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 4, "suspicious": 3, "undetected": 33 }, "detections": { "CRDF": "malicious", "VIPRE": "malware", "Fortinet": "spam", "SOCRadar": "suspicious", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Porkbun LLC", "created": "2026-03-11T10:43:34Z", "expires": "2028-03-11T10:43:34Z", "updated": "2026-10-16T03:07:52Z", "first_seen": "2024-07-22T10:52:27Z", "dns": [ { "ttl": 300, "type": "TXT", "value": "google-site-verification=i9CxVJX0nkwyxzaSoq25dxW5dcfFc4dfXub95-pwVM8" }, { "ttl": 300, "type": "MX", "value": "route2.mx.cloudflare.net", "priority": 51 }, { "ttl": 300, "type": "A", "value": "172.67.173.155" }, { "ttl": 21600, "type": "NS", "value": "ed.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ed.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:ad9b" }, { "ttl": 300, "type": "MX", "value": "route3.mx.cloudflare.net", "priority": 90 }, { "ttl": 21600, "type": "NS", "value": "leanna.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "route1.mx.cloudflare.net", "priority": 34 }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:_spf.mx.cloudflare.net ~all" }, { "ttl": 300, "type": "A", "value": "104.21.96.61" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:603d" } ], "dns_at": "2026-10-24T23:04:37Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.swapgo.io", "swapgo.io" ], "issuer": "Let's Encrypt / YE2", "serial": "6083a06662b706d0e50a5e9935195125e5f", "sha256": "4b1373d4cf166fd1659e74a70a0294befb5e054c1c334708ed56394e65e06151", "subject": "swapgo.io", "valid_to": "2026-12-03T14:49:12Z", "valid_from": "2026-09-04T14:49:13Z" }, "whois": { "registrar": "Porkbun LLC", "registrar_iana_id": "1861", "registrar_url": "http://porkbun.com", "created": "2026-03-11T10:43:34Z", "updated": "2026-10-16T03:07:52Z", "expires": "2028-03-11T10:43:34Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "renewPeriod" ], "nameservers": [ "ed.ns.cloudflare.com", "leanna.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "delete prohibited", "transfer prohibited" ], "events": { "expiration": "2028-03-11T10:43:35Z", "last changed": "2026-10-16T03:07:52Z", "registration": "2026-03-11T10:43:35Z", "registrar expiration": "2028-03-11T10:43:35Z", "last update of RDAP database": "2026-03-11T10:43:34Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T03:46:07Z", "mail_config": { "mx": [ "route3.mx.cloudflare.net", "route1.mx.cloudflare.net", "route2.mx.cloudflare.net" ], "spf": "v=spf1 include:_spf.mx.cloudflare.net ~all", "dane": true, "spf_lookups": 1 }, "caa_records": { "domain": "swapgo.io" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T03:34:12Z", "first": "2024-07-22T10:43:39Z", "changes": 2, "days_archived": 3, "scans_per_day": 0, "avg_page_bytes": 4481 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "https://swapgo.io/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 581 }, "social_tags": { "ogUrl": "https://swapgo.io", "title": "SwapGo — Instant Crypto Swap", "ogType": "website", "ogImage": "https://swapgo.io/brand/logo-512.png", "ogTitle": "SwapGo — Instant Crypto Swap", "ogSiteName": "SwapGo", "description": "SwapGo offers non-custodial, unlimited crypto swaps. 1000+ assets, ~2 min average completion, no sign-up required.", "twitterCard": "summary", "canonicalUrl": "https://swapgo.io", "ogDescription": "SwapGo offers non-custodial, unlimited crypto swaps. 1000+ assets, ~2 min average completion, no sign-up required." }, "trackers": { "requests": 38 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1247, "tls": 23, "wait": 152, "connect": 7, "download": 4 }, "response_ms": 1433 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 50781, "co2_grams": 0.0019, "cleaner_than": 37 }, "dns_server": { "ns": [ { "ip": "162.159.38.151", "host": "leanna.ns.cloudflare.com" }, { "ip": "108.162.193.111", "host": "ed.ns.cloudflare.com" } ], "zone": "swapgo.io" }, "cookies": { "cookies": [ { "name": "swapgo-locale", "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3033::ac43:ad9b", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "swapgo.io" }, "dns": { "A": [ "104.21.96.61", "172.67.173.155" ], "MX": [ "{\"exchange\": \"route1.mx.cloudflare.net\", \"priority\": 34}", "{\"exchange\": \"route3.mx.cloudflare.net\", \"priority\": 90}", "{\"exchange\": \"route2.mx.cloudflare.net\", \"priority\": 51}" ], "NS": [ "leanna.ns.cloudflare.com", "ed.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ed.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414761512, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=i9CxVJX0nkwyxzaSoq25dxW5dcfFc4dfXub95-pwVM8", "v=spf1 include:_spf.mx.cloudflare.net ~all" ], "AAAA": [ "2606:4700:3033::ac43:ad9b", "2606:4700:3037::6815:603d" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::6815:603d", "family": 6 }, "redirects": { "chain": [ "https://swapgo.io" ] }, "subdomains": { "count": 1, "subdomains": [ "www.swapgo.io" ] }, "linked_pages": { "internal_count": 58 }, "whois": { "registrar": "Porkbun LLC", "created": "2026-03-11T10:43:34Z", "updated": "2026-10-21T03:08:23Z", "expires": "2028-03-11T10:43:34Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ed.ns.cloudflare.com", "leanna.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```