sim-pleswap[.]org

PhishDestroy identifies sim-pleswap.org as an active crypto credential theft page masquerading as the legitimate SimpleSwap.io exchange platform. This domain employs brand impersonation to trick users into surrendering wallet credentials or transaction approvals, typical behavior of a crypto drainer kit. The page title mirrors SimpleSwap’s branding, leveraging visual similarity to bypass user scrutiny and facilitate unauthorized fund transfers.

This domain was flagged by PhishDestroy with the following technical indicators: VirusTotal detection score of 2/95, registered through Dynadot Inc, resolving to IP address 176.125.242.151, created on April 02, 2026, secured with a Let's Encrypt SSL certificate, and currently not blocked by Google Safe Browsing. It remains absent from major threat intelligence blocklists, increasing exposure to potential victims.

As of this report, sim-pleswap.org remains active and poses a moderate but evolving risk due to low detection coverage and active hosting. Immediate actions include blocking the domain at DNS and network levels, updating endpoint protection signatures, and warning users to verify URLs via official SimpleSwap.io channels. While current intelligence suggests low immediate threat due to limited propagation, the domain’s recent creation and zero detections indicate a high potential for escalation. Continuous monitoring is advised as this campaign may expand rapidly across social media and phishing channels.