# PhishDestroy domain threat record: xswap.click Content language: English Canonical HTML report: https://phishdestroy.io/domain/xswap.click/ Machine-readable companion: https://phishdestroy.io/domain/xswap.click/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:41:05 UTC - Last availability or vendor check: 2026-10-23 02:19:50 UTC - Stored record updated: 2026-10-23 06:23:50 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: arbitrum ## Stored infrastructure - Observed IP address: 104.21.20.30 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, xswap.click): 2026-07-10 01:39:36 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1668d-59d5-7636-8c7e-adf73f7fad6c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/xswap.click - Certificate Transparency search: https://crt.sh/?q=%25.xswap.click - Web Archive lookup: https://web.archive.org/web/*/https://xswap.click/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classified xswap.click as a crypto wallet drainer. The recorded page title was “Xswap”. The domain was first seen by PhishDestroy on 2026-10-23 with an HTTP 200 response. The prior AI assessment noted insufficient page content to determine behavior. How the scam works A crypto wallet drainer typically invites a visitor to connect a Web3 wallet and then uses the granted approvals to move assets to attacker‑controlled addresses. The site may pose as a legitimate DeFi service to encourage users to approve malicious transactions. Evidence VirusTotal scanned the domain on 2026-10-22 and reported two detections out of 92 engines: one malicious (Chong Lua Dao) and one suspicious (URLQuery). Google Safe Browsing checked on 2026-10-23 and returned no flag. External blocklists MetaMask and SEAL listed the domain as of 2026-10-23, and PhishDestroy’s internal blocklist also contains it. OTX recorded two pulses referencing the domain on 2026-10-23. Cloudflare Radar flagged the site as phishing, while urlscan.io recorded an overall clean verdict but its engine score marked the site malicious with a high‑confidence tag. Spamhaus DBL reported no listing on the check date. Infrastructure The domain was registered with Spaceship, Inc. on 2026-07-10, giving it an age of 105 days at first sighting. Recorded IP addresses were 104.21.20.30 and 172.67.191.2, both associated with Cloudflare, Inc. in Canada. The TLS certificate, issued by Google Trust Services, was valid from 2026-09-07 to 2026-12-06 and covered only the apex domain. Nameservers were ajay.ns.cloudflare.com and colette.ns.cloudflare.com, and DNSSEC was not enabled. What to do Visitors should avoid connecting any wallet to xswap.click; if approvals were granted, revoke them and consider moving funds to a new wallet. Organizations should block the domain at DNS or firewall level and monitor outbound connections to the recorded Cloudflare IPs, reviewing logs for any wallet‑related activity that originated from this address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1668d-59d5-7636-8c7e-adf73f7fad6c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/7ac9d5c0-475a-488c-b99f-25aa3761b59a Stored capture screenshot: https://i.ibb.co/fVxnKL57/53096eb0688e.png Cloudflare Radar screenshot (2026-10-23T02:03:28Z): https://screenshots.phishdestroy.io/cf/7ac9d5c0-475a-488c-b99f-25aa3761b59a.png URLScan screenshot (2026-10-03T14:16:23Z): https://screenshots.phishdestroy.io/us/01a1021f-6cf5-73ee-9daa-c6504dfc7da4.png URLScan capture report: https://urlscan.io/result/01a1021f-6cf5-73ee-9daa-c6504dfc7da4/ URLScan screenshot (2026-10-04T01:42:59Z): https://screenshots.phishdestroy.io/us/01a10494-0777-740c-8227-c0f5b3765108.png URLScan capture report: https://urlscan.io/result/01a10494-0777-740c-8227-c0f5b3765108/ URLScan screenshot (2026-10-04T05:48:45Z): https://screenshots.phishdestroy.io/us/01a10575-0b94-738a-b7d5-9edb774e5ca1.png URLScan capture report: https://urlscan.io/result/01a10575-0b94-738a-b7d5-9edb774e5ca1/ URLScan screenshot (2026-10-12T09:07:24Z): https://screenshots.phishdestroy.io/us/01a12f5d-b729-7256-96ce-e17122ef3649.png URLScan capture report: https://urlscan.io/result/01a12f5d-b729-7256-96ce-e17122ef3649/ URLScan screenshot (2026-10-16T07:09:49Z): https://screenshots.phishdestroy.io/us/01a1438b-5953-776b-8e53-e3a012c5b8ff.png URLScan capture report: https://urlscan.io/result/01a1438b-5953-776b-8e53-e3a012c5b8ff/ VirusTotal report: https://www.virustotal.com/gui/domain/xswap.click Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xswap.click Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 02:45:43 UTC ## Stored page captures - Primary capture: https://i.ibb.co/fVxnKL57/53096eb0688e.png Captured: 2026-10-23 02:19:50 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a1668d-59d5-7636-8c7e-adf73f7fad6c.png Captured: 2026-10-23 02:19:50 UTC Source report: https://urlscan.io/result/01a1668d-59d5-7636-8c7e-adf73f7fad6c/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a15828-672d-72cd-a3f0-cc5f04ac9fe5.png Captured: 2026-10-23 01:41:05 UTC Source report: https://urlscan.io/result/01a1668d-59d5-7636-8c7e-adf73f7fad6c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7ac9d5c0-475a-488c-b99f-25aa3761b59a.png Captured: 2026-10-23 02:03:28 UTC Source report: https://radar.cloudflare.com/scan/7ac9d5c0-475a-488c-b99f-25aa3761b59a SHA-256: 3287f57e9314adb40313f86b4da37cc15d85c515c6a1a2336a43c53c2a99c337 - URLQuery: https://screenshots.phishdestroy.io/uq/6d0945f4-70de-423e-bb38-c6d6e5dd0170.png Source report: https://urlquery.net/report/6d0945f4-70de-423e-bb38-c6d6e5dd0170 SHA-256: f28a47f9f992d7b1c35fdbef3e7ee380d802617063d41d74842b01f2e9cee607 - URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a1021f-6cf5-73ee-9daa-c6504dfc7da4.png Captured: 2026-10-03 14:16:23 UTC Source report: https://urlscan.io/result/01a1021f-6cf5-73ee-9daa-c6504dfc7da4/ SHA-256: 6a07a912c1d51f4115f17427bef991f8c3391820c8e51b9c49f80ba199c0fec1 - URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a103bd-a698-747c-9fe3-3e422bd46a87.png Captured: 2026-10-03 21:48:49 UTC Source report: https://urlscan.io/result/01a103bd-a698-747c-9fe3-3e422bd46a87/ SHA-256: 914f02d20ae60259dfeb9104208309346341076ec941cefadfa470be1b19d22d - URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10575-0b94-738a-b7d5-9edb774e5ca1.png Captured: 2026-10-04 05:48:45 UTC Source report: https://urlscan.io/result/01a10575-0b94-738a-b7d5-9edb774e5ca1/ SHA-256: a9f1522a3390b201eefe9556fdf19367a1357952cf77abc3839e1f3b593cb9ed - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11a00-da23-7682-8708-d33c496f6cd7.png Captured: 2026-10-08 05:33:54 UTC Source report: https://urlscan.io/result/01a11a00-da23-7682-8708-d33c496f6cd7/ SHA-256: 50e8dc676529539e62a6f26334b4ccfb68365b9cadc9618a3afe0cbf7e004bd7 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1438b-5953-776b-8e53-e3a012c5b8ff.png Captured: 2026-10-16 07:09:49 UTC Source report: https://urlscan.io/result/01a1438b-5953-776b-8e53-e3a012c5b8ff/ SHA-256: a3c600d38e37efba1699a7e9c116843fdb704f22b5815feeeeae727be08c9d2a - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16699-ccd5-742f-a93d-0d30c5cf4ffd.png Captured: 2026-10-23 02:32:07 UTC Source report: https://urlscan.io/result/01a16699-ccd5-742f-a93d-0d30c5cf4ffd/ SHA-256: b85d18ef1057346fcb8c612cd82a52fc2ef03535db862c3ee5ac6f90ba4d6c1c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T02:44:50Z", "uuid": "01a1668d-59d5-7636-8c7e-adf73f7fad6c", "scanned_at": "2026-10-23T02:18:30Z", "final_url": "https://xswap.click/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://xswap.click/", "from": "http://xswap.click/", "status": 307 } ], "ip": "104.21.20.30", "domains": [ "bsc-dataseed.bnbchain.org", "bsc-rpc.publicnode.com", "binance.nodereal.io", "public-bsc.nownodes.io", "bsc-dataseed.nariox.org", "bsc-dataseed4.ninicoin.io", "bsc-dataseed3.ninicoin.io", "bsc-dataseed2.ninicoin.io", "bsc-dataseed4.defibit.io", "bsc-dataseed3.defibit.io", "bsc-dataseed2.defibit.io", "bsc-dataseed4.bnbchain.org", "bsc-dataseed3.bnbchain.org", "bsc-dataseed2.bnbchain.org", "bsc-dataseed1.bnbchain.org", "api.xswap.app", "static.cloudflareinsights.com" ], "ips": [ "43.153.193.136", "52.70.28.137", "104.20.35.2", "104.20.24.117", "13.248.167.185", "76.223.51.123", "99.83.204.86", "75.2.38.186", "184.193.117.88", "3.222.136.24", "104.16.80.73", "104.21.20.30" ], "asns": [ "132203", "14618", "13335", "16509" ], "countries": [ "SG", "US" ], "link_domains": [ "about.xswap.app", "bscscan.com", "xswap-app.gitbook.io", "github.com", "t.me", "x.com", "solana.xswap.app" ], "social": [ "https://github.com/xswaplabs", "https://t.me/XSwap_app", "https://x.com/xswap_app" ], "doc_hash": "98c8241e227f0fc87da153c97d1ad8514483ad17c0829597bc2c4dc8d7543adf", "script_hashes": [ "6d104e6d302441cda9f571445162f998e778a0d3e09b4ab25b59eeccd3464b25" ], "globals": [ "__reactRouterVersion", "__cfBeacon" ], "storage_keys": [ "wagmi.store", "wagmi-xswap.store", "__chainId" ], "tls": { "san": [ "xswap.click" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "xswap.click", "protocol": "QUIC", "valid_to": "2026-12-06T02:52:52Z", "valid_from": "2026-09-07T01:52:56Z" }, "domain_age_days": 105, "apex_age_days": 105, "tls_age_days": 46, "tls_valid_days": 90, "requests": 52, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:12:09Z", "uuid": "7ac9d5c0-475a-488c-b99f-25aa3761b59a", "scanned_at": "2026-10-23T02:03:28Z", "final_url": "https://xswap.click/", "status": 200, "history": [ { "url": "https://xswap.click/", "status": 200 } ], "dom_hash": "10734126b78b52d427f30b7898bd7124c7861c10c5806eecddbcdbcdb038ef84", "doc_hash": "67e74b2527204c36fb35cdf1daa93e2d155eed95e7029134d44d985555ee860a", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "xswap.click", "type": "A", "value": "172.67.191.2" }, { "name": "xswap.click", "type": "A", "value": "104.21.20.30" }, { "name": "xswap.click", "type": "AAAA", "value": "2606:4700:3032::ac43:bf02" }, { "name": "xswap.click", "type": "AAAA", "value": "2606:4700:3037::6815:141e" } ], "dnssec_valid": false, "ip": "172.67.191.2", "whois": { "registrar": "Spaceship, Inc.", "created": "2026-07-10T01:39:36Z", "updated": "2026-07-15T01:40:04Z", "expires": "2027-07-10T01:39:36Z", "nameservers": [ "ajay.ns.cloudflare.com", "colette.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:40:04Z", "analysis_at": "2026-10-22T12:40:11Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 1, "undetected": 37 }, "detections": { "URLQuery": "suspicious", "Chong Lua Dao": "malicious" }, "reputation": 0, "registrar": "Spaceship, Inc.", "created": "2026-07-10T01:39:36Z", "expires": "2027-07-10T01:39:36Z", "updated": "2026-07-15T01:40:04Z", "first_seen": "2026-07-10T02:11:09Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ajay.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ajay.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.20.30" }, { "ttl": 300, "type": "A", "value": "172.67.191.2" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:bf02" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:141e" }, { "ttl": 21600, "type": "NS", "value": "colette.ns.cloudflare.com" } ], "dns_at": "2026-10-22T12:40:30Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "xswap.click" ], "issuer": "Google Trust Services / WE1", "serial": "6079bf26c4ed068f130a14faeba5d776", "sha256": "8dece81bd8e3bcd33507b3554206d2fb100f9cb722e89f7b17e29aa72d3283eb", "subject": "xswap.click", "valid_to": "2026-12-06T02:52:52Z", "valid_from": "2026-09-07T01:52:56Z" }, "whois": { "registrar": "Spaceship, Inc.", "registrar_iana_id": "3862", "registrar_url": "https://www.spaceship.com/", "created": "2026-07-10T01:39:36Z", "updated": "2026-07-15T01:40:04Z", "expires": "2027-07-10T01:39:36Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ajay.ns.cloudflare.com", "colette.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-07-10T01:39:37Z", "registration": "2026-07-10T01:39:36Z", "registrar expiration": "2027-07-10T01:39:36Z", "last update of RDAP database": "2026-10-21T14:14:57Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:12:30Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "xswap.click" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:50:27Z", "first": "2026-10-23T01:50:27Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2801 }, "social_tags": { "ogUrl": "https://xswap.app", "title": "Xswap", "ogType": "website", "ogImage": "https://xswap.app/logo.png", "ogTitle": "Xswap - DEX Aggregator | Best Price, MEV Protection & AI Security", "ogSiteName": "Xswap", "themeColor": "#fff", "description": "Trade across top DEXs with the best price routing. Xswap aggregates liquidity, protects against MEV, and uses AI for secure swaps. Fast, secure, and smart DeFi trading.", "twitterCard": "summary_large_image", "twitterSite": "@xswap_app", "canonicalUrl": "https://xswap.app", "ogDescription": "Trade across top DEXs with the best price routing. MEV protection, AI security. Fast, secure, and smart DeFi trading." }, "trackers": { "requests": 24 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 25, "wait": 59, "connect": 10, "download": 1 }, "response_ms": 97 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 4562, "co2_grams": 0.0002, "cleaner_than": 89 }, "dns_server": { "ns": [ { "ip": "108.162.194.28", "host": "colette.ns.cloudflare.com" }, { "ip": "172.64.33.56", "host": "ajay.ns.cloudflare.com" } ], "zone": "xswap.click" }, "location": { "ip": "2606:4700:3037::6815:141e", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "xswap.click" }, "dns": { "A": [ "172.67.191.2", "104.21.20.30" ], "NS": [ "colette.ns.cloudflare.com", "ajay.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ajay.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414431363, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3037::6815:141e", "2606:4700:3032::ac43:bf02" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::ac43:bf02", "family": 6 }, "redirects": { "chain": [ "https://xswap.click" ] }, "social_presence": { "profiles": [ "https://x.com/xswap_app" ] }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-07-10T01:39:36Z", "updated": "2026-07-15T01:40:04Z", "expires": "2027-07-10T01:39:36Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ajay.ns.cloudflare.com", "colette.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```