simplswap[.]org

On 23 July 2026 analysts observed the domain simplswap.org, registered on 21 February 2026 via CSL Computer Service Langenbach GmbH d/b/a joker.com. The site presents the page title “SimpleSwap Exchange | Easy way to swap BTC, LTC and more”, indicating a crypto‑exchange façade. The domain is classified as a crypto scam that impersonates the brand “across”. Trust‑assessment services assign it a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, reflecting extreme lack of credibility.

DNS resolution points to IP address 91.92.243.31, which belongs to the Netherlands under AS202412 owned by Omegatech LTD. The IP address and the domain are listed on four independent security blocklists and have been cited in thirteen AlienVault OTX threat‑intel pulses, confirming repeated malicious use. VirusTotal analysis shows that 18 of 93 scanning engines flag the domain, reinforcing the malicious reputation. The SSL certificate is identified as type E7, and the site is currently taken offline, as indicated by the status field.

Additional defensive feeds, including PhishDestroy, Polkadot, Enkrypt and Codeesura, have also blocked the domain. Evidence suggests that the infrastructure was actively used to lure cryptocurrency users by mimicking a legitimate exchange service, but the exact operational details, such as the phishing kit or command‑and‑control endpoints, remain unknown. Defenders should continue to block the domain and associated IP address at network perimeters, update URL filtering and threat‑intel feeds, and monitor for any re‑registration attempts or similar domains that reuse the same registrar or hosting ASN. Ongoing observation of the OTX pulses and blocklist updates is recommended to detect potential resurgence or related campaigns.