PhishDestroy first observed simpleswap.ac.nz on Jul 30, 2026. Stored content metadata identifies Across as the apparent target. The captured page title is “SimpleSwap — Instant, No-KYC Crypto Swaps Explained”. Page analysis recorded additional brand references to Binance, Bybit, Coinbase, Ethereum, Facebook, Kraken, Kucoin, and Solana. Stored page analysis classifies the content as fake exchange. Current evidence score: 72/100 (critical).
Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 4 detections among 91 engines: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, SOCRadar on Aug 7, 2026 at 02:12 UTC. Spamhaus DBL: DBL_SPAM on Jul 30, 2026 at 22:30 UTC. Non-positive and contextual checks: On Jul 30, 2026 at 19:28 UTC, AlienVault OTX listed 2 community pulse references (not vendor detections); URLQuery recorded no positive detection. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Jul 30, 2026 at 19:27 UTC. URLScan completed without a malicious verdict (score 0) on Aug 1, 2026 at 03:30 UTC.
HTTP 200 was recorded on Aug 8, 2026 at 10:37 UTC. Registration records for the domain list Dynadot Inc as the registrar and Jun 2, 2026 as the creation date. At collection time, the hostname resolved to 45.131.214.175 on AS200823 (MHost LLC). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is nginx. DOM analysis on Jul 30, 2026 at 22:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 28, 2026; checked Jul 30, 2026 at 22:02 UTC.
The content indicators and 2 positive source findings support the current Across-themed fake exchange classification.