simpleswap[.]at

The domain simpleswap.at was identified as a crypto drainer phishing threat, currently offline after posing as a cryptocurrency trading platform under the title "CryptoBot – Automated Trading Bot." This domain was designed to trick users into connecting their crypto wallets, thereby enabling the theft of digital assets through malicious smart contract interactions. The domain is now inactive, but its infrastructure remains a risk for future campaigns.

Technical analysis reveals that simpleswap.at was flagged by 16 of 95 VirusTotal vendors, indicating broad consensus on its malicious nature. It also appeared on six security blocklists and was tracked in 16 threat intelligence pulses on AlienVault OTX. The domain was registered through Key-Systems GmbH and resolved to IP address 45.10.243.93. Its SSL certificate was issued by Let's Encrypt (R13), a common choice for phishing sites due to its free and automated nature. These indicators collectively confirm that the domain was purpose-built for credential theft and crypto asset draining.

Although simpleswap.at has been taken offline, users who may have interacted with it should immediately revoke any permissions granted to the site and transfer funds to secure wallets. PhishDestroy recommends monitoring for similar domains using the same IP or registrar and educating users to verify URLs before connecting wallets. Always enable two-factor authentication and use hardware wallets for high-value assets. Vigilance remains critical as threat actors frequently rotate domains and infrastructure to evade detection.