simpleswap[.]online

Analysis of the domain simpleswap.online indicates it is a confirmed crypto scam site that has been taken offline as of the report date, July 24, 2026. The domain was registered on July 29, 2025, through Porkbun LLC, a registrar commonly used for both legitimate and malicious domains. Infrastructure analysis reveals the domain resolved to the IP address 176.46.152.93, located in Iran and associated with AS44208 (Farahoosh Dena PLC). No SSL certificate was detected, increasing the risk of unencrypted data transmission.

The domain appears on two security blocklists and has been flagged in 15 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition of its malicious nature. Detection vendors PhishDestroy and CryptoFirewall have explicitly blocked access to this domain, further corroborating its classification as a crypto scam. VirusTotal reports that 14 out of 95 security vendors have flagged simpleswap.online, though the absence of additional context limits the granularity of these detections. The page title, 'Krypto Swap,' aligns with the scam type identified in threat intelligence reports, indicating the domain likely impersonated a cryptocurrency exchange or swap service to deceive users.

Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its malicious classification. While the domain is currently offline, defenders should treat any future resolution or re-registration of simpleswap.online as a high-risk event. Organizations are advised to block the domain at the DNS level and monitor for related infrastructure, such as the associated IP address and nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). No further details about the specific content or targeting methods are available at this time.