simpleswap-io[.]at

Analysis of the domain simpleswap-io.at indicates active brand impersonation targeting cryptocurrency users. Registered on October 20, 2025, through an undisclosed registrar, the domain resolves to the IP address 213.209.129.68, hosted on AS208185 (Net Gate Telecom S.R.L.) in the Netherlands. The site presents itself with the page title 'SimpleSwap | Exchange Cryptocurrency,' directly mimicking the branding of a legitimate cryptocurrency exchange platform. Infrastructure analysis reveals the use of Nginx and OpenResty, common technologies for both legitimate and malicious sites, while the SSL certificate is issued by Let's Encrypt, a neutral indicator often exploited in phishing operations. The domain is flagged by 18 of 95 security vendors in aggregated threat intelligence feeds, with detection labels including cryptocurrency scam and brand impersonation. It appears on five security blocklists and has been incorporated into 14 threat intelligence pulses, suggesting sustained malicious activity. Multiple security platforms, including MetaMask, Polkadot, PhishDestroy, SEAL, and Enkrypt, have explicitly blocked this domain, reinforcing its classification as high-risk. Nameservers coco.bunny.net and kiki.bunny.net are associated with the domain, though their historical use in other campaigns remains unverified in this report. While the exact content and functionality of the site have not been fully analyzed, the combination of brand impersonation, cryptocurrency-themed page title, and widespread security vendor detections strongly indicates an active scam operation. Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels. Further monitoring of associated infrastructure, including the IP address and nameservers, may reveal additional related threats.