# PhishDestroy domain threat record: trocador-app.is

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/trocador-app.is/
Machine-readable companion: https://phishdestroy.io/domain/trocador-app.is/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-10 13:46:41 UTC
- Last availability or vendor check: 2026-10-21 01:19:46 UTC
- Stored record updated: 2026-10-22 14:24:42 UTC
- VirusTotal detections in the stored snapshot: 11/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: 1inch

## Stored infrastructure

- Observed IP address: 192.162.199.238
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registration date (registry RDAP, trocador-app.is): 2026-10-06 21:40:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1260e-fd5b-755d-898a-3146ed892a0b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/trocador-app.is
- Certificate Transparency search: https://crt.sh/?q=%25.trocador-app.is
- Web Archive lookup: https://web.archive.org/web/*/https://trocador-app.is/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
trocador-app.is is a phishing page that imitated Trocador, a crypto swap aggregator popular with people who want quick, low-friction exchanges between coins. The page presented itself simply as "Trocador", and the domain swaps the brand's own address for a hyphenated lookalike on the .is extension. PhishDestroy first flagged it on 2026-10-10. The site has been offline since 2026-10-17 and was still dead at our check on 2026-10-19.

How the scam works
Fake swap sites copy the look of a real aggregator so a visitor believes they are starting a normal exchange. The victim picks a pair, enters an amount and is shown a deposit address. That address belongs to the operators, so the coins are taken and nothing is returned. Clones like this may also ask for a wallet connection or a recovery phrase under the pretext of verifying a swap, which hands over control of the wallet. Because Trocador's users often value speed and minimal sign-up, a convincing copy meets little suspicion.

Evidence
Eleven of 92 VirusTotal engines flagged the domain by 2026-10-14. The named detections include BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai, CRDF and Ermes. The domain also appears on the MetaMask and SEAL blocklists, two lists maintained specifically against crypto threats, in addition to PhishDestroy's own. Three AlienVault OTX threat pulses reference it, so other researchers tracked it independently.

Infrastructure
The domain was registered on 2026-10-06 and was already serving the fake page when we caught it four days later. That short gap is typical of throwaway phishing domains spun up for a single campaign. The server sat in Germany on a network operated by FEMO IT Solutions Limited, a UK-registered provider. Its Let's Encrypt certificate shows that the padlock in the browser proved only an encrypted connection, not that the site was genuine.

What to do
If you sent coins to a deposit address shown on this site, save the transaction IDs and the address and report them to the exchange or service you sent from; on-chain transfers cannot be reversed by the scammers' host. If you typed a recovery phrase anywhere on the page, treat that wallet as compromised and move the remaining funds to a new wallet created from a fresh phrase. If you connected a wallet, review and revoke any token approvals you granted during the visit. For future swaps, reach Trocador only through an address you have verified yourself. Security teams should block trocador-app.is and watch for other Trocador lookalikes on alternate extensions.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1260e-fd5b-755d-898a-3146ed892a0b/
VirusTotal report: https://www.virustotal.com/gui/domain/trocador-app.is
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trocador-app.is
Archived copy: https://web.archive.org/web/20261010134846/https://trocador-app.is/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 11:04:59 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1260e-fd5b-755d-898a-3146ed892a0b.png
  Captured: 2026-10-10 13:46:41 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1260e-fd5b-755d-898a-3146ed892a0b.png
  Captured: 2026-10-10 13:46:41 UTC
  Source report: https://urlscan.io/result/01a1260e-fd5b-755d-898a-3146ed892a0b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2ce824e4-d2e2-43ca-929e-907f5b161995.png
  Captured: 2026-10-10 14:20:12 UTC
  Source report: https://radar.cloudflare.com/scan/2ce824e4-d2e2-43ca-929e-907f5b161995
  SHA-256: 1d6cd6d428e7d39f94e33af4621f6ae0d4da15d051eb7a46fb4ab222fbdcdd22
- URLQuery: https://screenshots.phishdestroy.io/uq/22c652d2-f296-4f3c-9f21-65ea61c33fd4.png
  Source report: https://urlquery.net/report/22c652d2-f296-4f3c-9f21-65ea61c33fd4
  SHA-256: 721b718adc3a4bb3e1bd34067802604b7e1e63e30b290fd7efea6ae9c3fe8b7c
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12612-f62d-72fe-8696-876cc04623b7.png
  Captured: 2026-10-10 13:49:11 UTC
  Source report: https://urlscan.io/result/01a12612-f62d-72fe-8696-876cc04623b7/
  SHA-256: 3bf51b5312feab6362a38a43b079a291561128200d720183fbcbfef2202c2164

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:35:12Z",
        "uuid": "01a1260e-fd5b-755d-898a-3146ed892a0b",
        "scanned_at": "2026-10-10T13:44:45Z",
        "final_url": "https://trocador-app.is/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://trocador-app.is/",
                "from": "http://trocador-app.is/",
                "status": 307
            }
        ],
        "ip": "192.162.199.238",
        "domains": [
            "adm.stevekolo13.workers.dev",
            "cdn.jsdelivr.net",
            "fonts.gstatic.com",
            "price.stevekolo13.workers.dev",
            "www.clarity.ms",
            "fonts.googleapis.com",
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "142.251.14.94",
            "188.114.96.3",
            "188.114.97.3",
            "20.250.198.32",
            "2a00:1450:4001:c17::5f",
            "104.17.24.14",
            "2a04:4e42:600::485",
            "192.162.199.238"
        ],
        "asns": [
            "15169",
            "13335",
            "8075",
            "54113",
            "214351"
        ],
        "countries": [
            "US",
            "CH",
            "DE"
        ],
        "link_domains": [
            "x.com",
            "t.me",
            "matrix.to"
        ],
        "social": [
            "https://x.com/trocadorapp",
            "https://t.me/TrocadorimSupportBot"
        ],
        "doc_hash": "51daaa023368d61465e49265f186dfae7dc7d3d48f3e05a5f23460d750db4396",
        "script_hashes": [
            "6a727c1052291db47405f6f494aeee5997440b266e785cb2e162a37a3a0574b7",
            "b9ea07a63987b82476c71e3412d1d1282bb3831525001a72357830a140dce1c4",
            "604d6ff53b02854e5e93a7b06c6dc079a38362c5660e332eb89da4b4a7c7d13a",
            "9ffd858e3a71892b49cce83a7ac5a6bdf8ae20d7aca61f29d0db206057361310"
        ],
        "globals": [
            "clarity",
            "_pricePromise",
            "_walletPromise",
            "uidEvent",
            "bootstrap",
            "getCoinInfo",
            "handleSwapSubmit",
            "handleExchangeSubmit",
            "_sessionReady",
            "getCoinGeckoIdForSwap",
            "_savePriceCache",
            "fetchLivePrices",
            "_applyLivePricesToInputs",
            "getLivePrice",
            "updateDropdownPrices",
            "initLivePrices",
            "ShowFromUSDValue",
            "ShowToUSDValue",
            "CoinFromSearch",
            "CoinToSearch",
            "selectNewCoinFrom",
            "selectNewCoinTo",
            "CoinSwap",
            "TogglePayment",
            "I18n",
            "WORKER_URL",
            "livePriceCache",
            "liveMappedCache",
            "PRICE_FRESH_MS"
        ],
        "storage_keys": [
            "wallet_addresses_v1",
            "price_cache_v1"
        ],
        "tls": {
            "san": [
                "trocador-app.is"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "trocador-app.is",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-06T19:11:49Z",
            "valid_from": "2026-10-08T19:11:50Z"
        },
        "domain_age_days": 63,
        "apex_age_days": 63,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 92,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 85,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericcrypto"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Crypto"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:49Z",
        "uuid": "2ce824e4-d2e2-43ca-929e-907f5b161995",
        "scanned_at": "2026-10-10T14:20:12Z",
        "final_url": "https://trocador-app.is/",
        "status": 200,
        "history": [
            {
                "url": "https://trocador-app.is/",
                "status": 200
            }
        ],
        "dom_hash": "9d2d3575fe8af1b10e1f5cef379854e8d8af65afe0e1ef336c62b914683bec5d",
        "doc_hash": "be338675578a552c9853459d1cc7bfbcb00eff08426c9151b46ce0ad497a02da",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "trocador-app.is",
                "type": "A",
                "value": "192.162.199.238"
            }
        ],
        "dnssec_valid": false,
        "ip": "192.162.199.238",
        "whois": {
            "created": "2026-10-06T21:40:01Z",
            "updated": "2026-10-06T21:45:00Z",
            "nameservers": [
                "olga.ns.cloudflare.com",
                "sage.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:03:43Z",
        "analysis_at": "2026-10-19T09:57:13Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 11,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "Ermes": "not recommended",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "expires": "2027-10-06T00:00:00Z",
        "first_seen": "2026-08-17T13:14:47Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "forwadm.isnic.is",
                "value": "forwarding00.isnic.is"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "192.162.199.238"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "forwarding01.isnic.is"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "forwarding00.isnic.is"
            }
        ],
        "dns_at": "2026-10-15T02:49:34Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "trocador-app.is"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6d88f6434c4aa22615b656b76ed5f65e074",
            "sha256": "7a9d9f5c8d141c5656d0de3b9f1bd0dbec0dfb5f68c3e3964d3c04a52c7448da",
            "subject": "trocador-app.is",
            "valid_to": "2027-01-06T19:11:49Z",
            "valid_from": "2026-10-08T19:11:50Z"
        },
        "whois": {
            "dnssec": "unsigned delegation"
        },
        "rdap": {
            "status": [
                "server hold"
            ],
            "events": {
                "last changed": "2026-10-16T17:40:02Z",
                "registration": "2026-10-06T21:40:01Z",
                "soft expiration": "2027-10-06T21:30:02Z"
            }
        }
    }
}
```