simpleswap[.]mobi

This domain, simpleswap.mobi, is identified as a phishing site designed to impersonate a legitimate cryptocurrency exchange platform. The site mimics the branding and functionality of a real crypto swap service, likely aiming to deceive users into entering sensitive credentials, wallet addresses, or financial information under false pretenses. Analysis indicates the domain was crafted to exploit trust in established crypto services, potentially leading to unauthorized access to user funds or personal data. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolves to the IP address 158.94.209.135. The site is hosted on Nginx and has been flagged by 13 out of 95 security vendors on VirusTotal, with an additional presence on one security blocklist. The page title, 'SimpleSwap Exchange - Instant Crypto Swap Service,' further confirms its intent to mislead users by closely resembling the legitimate service's branding. Users who visited simpleswap.mobi should immediately cease all interaction with the domain. If any credentials, wallet information, or personal data were entered, affected parties should revoke access to any linked accounts, monitor for unauthorized transactions, and update passwords on legitimate platforms. Additionally, users should scan their devices for malware or unauthorized access, as phishing sites may deploy malicious payloads or redirect to further exploit infrastructure. Reporting the domain to relevant security teams or financial institutions is recommended to mitigate potential risks.