# PhishDestroy domain threat record: switchfi.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/switchfi.app/ Machine-readable companion: https://phishdestroy.io/domain/switchfi.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:39:18 UTC - Last availability or vendor check: 2026-10-23 11:24:10 UTC - Stored record updated: 2026-10-23 18:22:46 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: 1inch ## Stored infrastructure - Observed IP address: 172.67.162.127 - Registrar in stored WHOIS data: Namecheap Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, switchfi.app): 2026-06-02 08:03:23 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a166c8-0c5d-75ae-b19e-39241c841271/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/switchfi.app - Certificate Transparency search: https://crt.sh/?q=%25.switchfi.app - Web Archive lookup: https://web.archive.org/web/*/https://switchfi.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added switchfi.app to its internal blocklist after VirusTotal reported eleven malicious and two suspicious detections on 2026-10-23. The recorded page title on 2026-10-23 was “SwitchFi — Swap & Exchange Crypto at the Best Rate, Any Chain”. The domain was first seen by PhishDestroy on 2026-10-23. How the scam works Detections of phishing classifications indicate the site could be used to present a fake cryptocurrency exchange that tricks users into entering wallet addresses or credentials, a common tactic in crypto‑related scams. Evidence VirusTotal scanned the domain on 2026-10-23 and returned thirteen detections, including eleven malicious and two suspicious across ninety‑two engines. Google Safe Browsing checked the domain on the same day and did not flag it. urlscan.io captured the site on 2026-10-19; its overall verdict was clean, but its engine scoring marked it malicious with a score of 100. External blocklists MetaMask and SEAL listed the domain (2 listings) and OTX recorded two pulses referencing it. PhishDestroy’s internal list marks the domain as blocked. Infrastructure The domain was registered on 2026-06-02 through Namecheap Inc., giving it an age of about 138 days at the time of observation. DNS records captured on 2026-10-23 listed Cloudflare A records 172.67.162.127 and 104.21.42.140 (and corresponding AAAA records), and the TLS certificate observed was issued by Google Trust Services, valid from 2026-09-29 to 2026-12-28. No DNSSEC records were present. What to do Visitors should avoid entering any cryptocurrency credentials, wallet addresses, or private keys on this site and monitor related accounts for unexpected activity. Security teams should block switchfi.app at the network perimeter, log any access attempts, and update threat feeds to include this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15458-6cb6-760d-8be6-f50d13dbfa04/ Cloudflare Radar report: https://radar.cloudflare.com/scan/92d3fe86-1c88-443b-85d9-7a51c24b262a Stored capture screenshot: https://urlscan.io/screenshots/01a15458-6cb6-760d-8be6-f50d13dbfa04.png Cloudflare Radar screenshot (2026-10-23T01:43:24Z): https://screenshots.phishdestroy.io/cf/92d3fe86-1c88-443b-85d9-7a51c24b262a.png URLScan screenshot (2026-10-02T11:11:41Z): https://screenshots.phishdestroy.io/us/01a0fc4f-eb34-723d-8ba7-7e9962e1a5fc.png URLScan capture report: https://urlscan.io/result/01a0fc4f-eb34-723d-8ba7-7e9962e1a5fc/ URLScan screenshot (2026-10-02T21:40:25Z): https://screenshots.phishdestroy.io/us/01a0fe8f-8615-759f-a3d0-517a772687e7.png URLScan capture report: https://urlscan.io/result/01a0fe8f-8615-759f-a3d0-517a772687e7/ URLScan screenshot (2026-10-03T01:35:25Z): https://screenshots.phishdestroy.io/us/01a0ff66-aeae-778f-8dc0-64cf90f1dbb5.png URLScan capture report: https://urlscan.io/result/01a0ff66-aeae-778f-8dc0-64cf90f1dbb5/ URLScan screenshot (2026-10-07T07:12:28Z): https://screenshots.phishdestroy.io/us/01a11534-a4a2-760c-ae95-05db92f5a095.png URLScan capture report: https://urlscan.io/result/01a11534-a4a2-760c-ae95-05db92f5a095/ URLScan screenshot (2026-10-11T10:26:05Z): https://screenshots.phishdestroy.io/us/01a12a7f-68b4-7479-9d4e-e3737f4a4e2f.png URLScan capture report: https://urlscan.io/result/01a12a7f-68b4-7479-9d4e-e3737f4a4e2f/ URLScan screenshot (2026-10-19T08:31:54Z): https://screenshots.phishdestroy.io/us/01a15349-bbf1-737a-8d5d-81a487489ebe.png URLScan capture report: https://urlscan.io/result/01a15349-bbf1-737a-8d5d-81a487489ebe/ VirusTotal report: https://www.virustotal.com/gui/domain/switchfi.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=switchfi.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 02:57:13 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a166c8-0c5d-75ae-b19e-39241c841271.png Captured: 2026-10-23 03:24:30 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a15458-6cb6-760d-8be6-f50d13dbfa04.png Captured: 2026-10-23 01:39:18 UTC Source report: https://urlscan.io/result/01a166c8-0c5d-75ae-b19e-39241c841271/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/92d3fe86-1c88-443b-85d9-7a51c24b262a.png Captured: 2026-10-23 01:43:24 UTC Source report: https://radar.cloudflare.com/scan/92d3fe86-1c88-443b-85d9-7a51c24b262a SHA-256: 159c90b2216d4787a183fe5727b84b8859bf879eeae0b2fdf87e93c1887f6409 - URLQuery: https://screenshots.phishdestroy.io/uq/63d86b60-5867-4386-ae4d-84608d6f322f.png Source report: https://urlquery.net/report/63d86b60-5867-4386-ae4d-84608d6f322f SHA-256: 0cf41b9c67ffbdb35ddbb38234fced78862a37546e795dc3997beb21e5df0d26 - URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fc4f-eb34-723d-8ba7-7e9962e1a5fc.png Captured: 2026-10-02 11:11:41 UTC Source report: https://urlscan.io/result/01a0fc4f-eb34-723d-8ba7-7e9962e1a5fc/ SHA-256: 807fabc5beeb6462ef5c4dbc632657dca72a8319372ae898fceaf0f27fbae8fe - URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fe8f-8615-759f-a3d0-517a772687e7.png Captured: 2026-10-02 21:40:25 UTC Source report: https://urlscan.io/result/01a0fe8f-8615-759f-a3d0-517a772687e7/ SHA-256: 5eb93ebde602c3d0a00bc5fb7a8f6781d46899ef85fcc87e98270396e15a74ae - URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a10044-efe5-722d-bdf4-051d25e0a75d.png Captured: 2026-10-03 05:38:12 UTC Source report: https://urlscan.io/result/01a10044-efe5-722d-bdf4-051d25e0a75d/ SHA-256: af50781a01d33047f72b3df1535b6388540286c07f8448d86c408bd12a39d235 - URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13eb8-1bdf-7319-9585-69564469d1fc.png Captured: 2026-10-15 08:40:26 UTC Source report: https://urlscan.io/result/01a13eb8-1bdf-7319-9585-69564469d1fc/ SHA-256: b427c0f1be5e99c3da7d9e2b7f3780767b86c510e4cb1cd3b93ee6b8c34d6f64 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15458-6cb6-760d-8be6-f50d13dbfa04.png Captured: 2026-10-19 13:27:36 UTC Source report: https://urlscan.io/result/01a15458-6cb6-760d-8be6-f50d13dbfa04/ SHA-256: f854e2766f69d6fc9349037909cc83955d5d9f816298cc3cd105b92d1fc152e3 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16688-2bb4-70c1-908b-53eb77497e85.png Captured: 2026-10-23 02:52:29 UTC Source report: https://urlscan.io/result/01a16688-2bb4-70c1-908b-53eb77497e85/ SHA-256: fe011f1269940826afe716dc3d46e66e7137bba1718035354290e3f7e237f4c6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T03:26:20Z", "uuid": "01a166c8-0c5d-75ae-b19e-39241c841271", "scanned_at": "2026-10-23T03:22:38Z", "final_url": "https://switchfi.app/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://switchfi.app/", "from": "http://switchfi.app/", "status": 307 } ], "ip": "172.67.162.127", "domains": [ "fonts.gstatic.com", "region1.google-analytics.com", "fonts.googleapis.com", "www.googletagmanager.com" ], "ips": [ "2001:4860:4802:34::36", "142.251.110.94", "2a00:1450:4001:c21::5f", "2a00:1450:4001:c15::61", "172.67.162.127" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "99041ef72afb4eeff03aff84a865e10993e0e417a07bcff2ed831da01676ee61", "script_hashes": [ "2a942e0c1758e3c55545b17b2268065be42d4f414e4594c3e76351859aa26aef", "0278ac8d4cdd84321e5234eb8722b46ec448bf4e4b81fe7d42364a2332a6e175", "358d9afbb1ab5befa2f48061a30776e5bcd7707f410a606ba985f98bc3b1c034" ], "globals": [ "gtag", "dataLayer", "sfIcon", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal", "iconSlug", "iconUrl", "safeIconUrl", "tronScanLogo", "previewDestinationAddress", "parseUnitsStr", "loadLib", "ensureEthers", "ensureSolanaWeb3", "explorerUrl", "sleep", "tokenStyle", "evmNamespaceProvider", "ensureEvmProvider", "legacyEvmName", "collectEvmChoices", "evmErr", "tronProviderObj", "tronWebNow", "connectTron", "tronHex", "tronTxIdFromHex", "sameTronAddress", "invalidLifiTronTransaction", "tronBytesHex", "tronProtoMessage", "tronProtoInt", "tronProtoUint", "tronProtoBytes", "tronProtoASCII", "decodeLifiTronRawData", "tronObject", "tronJSONInt" ], "tls": { "san": [ "switchfi.app", "*.switchfi.app" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "switchfi.app", "protocol": "QUIC", "valid_to": "2026-12-28T06:29:28Z", "valid_from": "2026-09-29T05:31:50Z" }, "domain_age_days": 141, "apex_age_days": 141, "tls_age_days": 23, "tls_valid_days": 90, "requests": 168, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T01:50:24Z", "uuid": "92d3fe86-1c88-443b-85d9-7a51c24b262a", "scanned_at": "2026-10-23T01:43:24Z", "final_url": "https://switchfi.app/", "status": 200, "history": [ { "url": "https://switchfi.app/", "status": 200 } ], "dom_hash": "8c043a43184bd17cccc410805642d4049c763b54ad6729f2df2ef5515ea99ca1", "doc_hash": "99041ef72afb4eeff03aff84a865e10993e0e417a07bcff2ed831da01676ee61", "phishing_v2": [ "phishing" ], "domain_risks": [ "Economy & Finance", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "switchfi.app", "type": "A", "value": "104.21.42.140" }, { "name": "switchfi.app", "type": "A", "value": "172.67.162.127" }, { "name": "switchfi.app", "type": "AAAA", "value": "2606:4700:3037::ac43:a27f" }, { "name": "switchfi.app", "type": "AAAA", "value": "2606:4700:3032::6815:2a8c" } ], "dnssec_valid": false, "ip": "104.21.42.140" }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:52:16Z", "analysis_at": "2026-10-23T02:06:17Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 11, "suspicious": 2, "undetected": 33 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-06-03T05:36:11Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "fiona.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:_spf.mx.cloudflare.net ~all" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:a27f" }, { "ttl": 21600, "type": "NS", "value": "lakas.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "route1.mx.cloudflare.net", "priority": 6 }, { "ttl": 21600, "type": "NS", "value": "fiona.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "route2.mx.cloudflare.net", "priority": 29 }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=wRiB35CgVEik23iE5OBcvcglZMAdjhCBXEDdRq_VR4M" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:2a8c" }, { "ttl": 300, "type": "MX", "value": "route3.mx.cloudflare.net", "priority": 45 }, { "ttl": 300, "type": "A", "value": "104.21.42.140" }, { "ttl": 300, "type": "A", "value": "172.67.162.127" } ], "dns_at": "2026-10-23T02:11:51Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "switchfi.app", "*.switchfi.app" ], "issuer": "Google Trust Services / WE1", "serial": "2415b79d03b9d60813fb8ecfb4fa00ec", "sha256": "94eacd78a52daafe034a04729b85a76532ebc444d4181313555dd12edbf77abf", "subject": "switchfi.app", "valid_to": "2026-12-28T06:29:28Z", "valid_from": "2026-09-29T05:31:50Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-06-02T08:03:23Z", "registrar expiration": "2027-06-02T08:03:23Z", "last update of RDAP database": "2026-10-22T12:27:43Z" }, "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T01:50:46Z", "mail_config": { "mx": [ "route1.mx.cloudflare.net", "route2.mx.cloudflare.net", "route3.mx.cloudflare.net" ], "spf": "v=spf1 include:_spf.mx.cloudflare.net ~all", "dane": true, "spf_lookups": 1 }, "caa_records": { "domain": "switchfi.app" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:47:34Z", "first": "2026-10-23T01:47:34Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 22976 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://switchfi.app/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 202 }, "social_tags": { "ogUrl": "https://switchfi.app/", "title": "SwitchFi — Swap & Exchange Crypto at the Best Rate, Any Chain", "ogType": "website", "robots": "index, follow", "ogImage": "https://switchfi.app/og.png", "ogTitle": "SwitchFi — Swap & Exchange Crypto at the Best Rate", "keywords": "crypto swap, crypto exchange, exchange crypto, convert crypto, cross-chain swap, cross-chain exchange, instant exchange, DEX aggregator, best rate, USDT bridge, Tron swap, Bitcoin swap, non-custodial", "themeColor": "#ffffff", "description": "SwitchFi is a non-custodial crypto exchange & swap router. Compare cross-chain routes across DEX aggregators to swap, exchange or convert crypto at the best rate — pay from EVM, Tron, Bitcoin or Solana.", "twitterCard": "summary_large_image", "canonicalUrl": "https://switchfi.app/", "ogDescription": "Non-custodial cross-chain swap & exchange router. Compare routes and settle at the best rate — EVM, Tron, Bitcoin, Solana." }, "trackers": { "requests": 157, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 6, "tls": 18, "wait": 824, "connect": 6, "download": 9 }, "response_ms": 863 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 104527, "co2_grams": 0.0038, "cleaner_than": 21 }, "dns_server": { "ns": [ { "ip": "173.245.58.157", "host": "fiona.ns.cloudflare.com" }, { "ip": "108.162.193.194", "host": "lakas.ns.cloudflare.com" } ], "zone": "switchfi.app" }, "location": { "ip": "2606:4700:3037::ac43:a27f", "asn": "13335", "org": "Cloudflare, Inc.", "city": "San Francisco", "country": "US" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "switchfi.app" }, "dns": { "A": [ "104.21.42.140", "172.67.162.127" ], "MX": [ "{\"exchange\": \"route3.mx.cloudflare.net\", \"priority\": 45}", "{\"exchange\": \"route1.mx.cloudflare.net\", \"priority\": 6}", "{\"exchange\": \"route2.mx.cloudflare.net\", \"priority\": 29}" ], "NS": [ "lakas.ns.cloudflare.com", "fiona.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"fiona.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416149241, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 include:_spf.mx.cloudflare.net ~all", "google-site-verification=wRiB35CgVEik23iE5OBcvcglZMAdjhCBXEDdRq_VR4M" ], "AAAA": [ "2606:4700:3032::6815:2a8c", "2606:4700:3037::ac43:a27f" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::ac43:a27f", "family": 6 }, "redirects": { "chain": [ "https://switchfi.app" ] }, "tech_stack": { "technologies": [ "Alpine.js", "Google Analytics", "Google Font API", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 11 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```