simple-swap[.]app

This domain, simple-swap.app, is identified as a phishing site impersonating a legitimate cryptocurrency exchange platform. Analysis indicates the site mimics the branding, layout, and functionality of a well-known crypto swap service to deceive users into entering sensitive credentials or transferring digital assets. The intent appears to be credential harvesting or direct crypto asset theft, targeting individuals seeking quick or low-fee cryptocurrency exchanges. The domain’s design and page title, 'Simpleswap - Exchange | Swap | Crypto | Try Now - Simple swap,' closely resemble authentic services, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 172.67.140.230, hosted under AS13335 (Cloudflare, Inc.), and is currently offline. It is registered through Cloudflare’s domain services and appears on one security blocklist, specifically PhishDestroy. VirusTotal detection rates show 18 out of 95 security vendors flagging the domain as malicious, a significant ratio indicating broad consensus among threat intelligence providers. Notably, the domain lacks an SSL certificate, a critical security gap that exposes user interactions to interception and further undermines trust. Users who visited simple-swap.app should take immediate remediation steps. Any credentials, wallet addresses, or private keys entered on the site should be considered compromised. Affected individuals should revoke access to connected wallets, change passwords on associated accounts, and monitor for unauthorized transactions. Cryptocurrency wallets used on the site should be audited for signs of tampering or unauthorized transfers. Given the domain’s offline status, users are advised to remain vigilant for follow-up phishing attempts via email or social engineering, as threat actors may pivot to alternative domains or communication channels to exploit previously collected data.