simpleswapl[.]org

The domain simpleswapl.org was registered on May 20, 2025 through Web Commerce Communications Limited dba WebNic.cc and resolves to the IP address 104.21.96.1, which is hosted by Cloudflare (ASN13335) in the United States. The site presents the page title "SimpleSwap.io: Easy Crypto Exchange and Instant Crypto Swap Platform," a title unrelated to the advertised target but consistent with a brand‑impersonation campaign that aims to lure Discord users. Analysis classifies the operation as a social‑media phishing attempt focused on the Discord brand.

The SSL certificate is issued by Cloudflare TLS Issuing ECC CA 1, confirming the use of Cloudflare’s edge services for TLS termination. Threat intelligence feeds have marked the domain as offline at the time of this report, and PhishDestroy has already blocked it. VirusTotal records indicate that one of ninety‑three security vendors flagged the domain, while Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence in malicious intent.

The domain appears on a single security blocklist, reinforcing its reputation as a malicious resource. Defenders should continue to block the domain at perimeter defenses, monitor for any re‑hosting attempts on alternative Cloudflare IPs, and add the domain to internal indicator‑of‑compromise (IOC) lists. Because the site is currently offline, no further HTTP payload or content analysis is available; further investigation should focus on any residual DNS records or cached content that could reveal additional phishing infrastructure or credential‑harvesting mechanisms.