simple-swap[.]to

This domain, simple-swap.to, is identified as a high-risk brand impersonation phishing site targeting cryptocurrency exchange users. Analysis indicates the domain mimics the legitimate SimpleSwap platform, using identical page titles such as SimpleSwap | Best Way To Swap Crypto | Exchange BTC, LTC, ETH and more. The threat type aligns with generic phishing, specifically designed to deceive users into entering sensitive credentials or transferring cryptocurrency to attacker-controlled wallets. No direct evidence of a crypto drainer kit was observed, but the impersonation tactic suggests credential harvesting or fraudulent transaction redirection as primary objectives. Technical indicators confirm the domain's malicious nature. VirusTotal detection shows 17 out of 95 security vendors flagging simple-swap.to as malicious. The domain was registered on August 08, 2025, through the Government of Kingdom of Tonga registrar, a known high-risk registration source. It resolves to the IP address 213.209.129.68, hosted in the Netherlands under AS208185 (Net Gate Telecom S.R.L.). The domain appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The SSL certificate is issued by Let's Encrypt (serial number E8), which, while providing encryption, does not validate the site's legitimacy. No Google Safe Browsing (GSB) status is explicitly provided, but the blocklist presence and vendor detections suggest broad recognition of its malicious intent. As of the latest assessment, simple-swap.to has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat due to the domain's recent creation and the registrar's lenient policies. Users who interacted with the site prior to its takedown should assume credential exposure and take immediate action, including revoking wallet approvals, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address to prevent future access attempts. The remaining risk persists due to the possibility of domain reactivation or migration to new infrastructure under similar impersonation tactics.