Analysis of simpleswap.ac.nz indicates this domain is actively hosting a phishing site targeting cryptocurrency exchange users. Registered on June 2, 2026, through Dynadot Inc, the domain currently resolves to IP address 45.131.214.175. Infrastructure analysis reveals Cloudflare nameservers (emma.ns.cloudflare.com and joel.ns.cloudflare.com), a common pattern among threat actors seeking to mask hosting origins and evade takedowns. As of July 30, 2026, the domain remains active and is blocked by PhishDestroy, appearing on at least one security blocklist.
No detections were reported by the 91 vendors scanning the domain on VirusTotal, though this absence does not confirm safety and may reflect delayed or incomplete coverage. The domain's registration age (under two months) and use of a country-code second-level domain (.ac.nz) with no clear affiliation to the targeted brand raise suspicion. The exact content and functionality of the site have not been fully analyzed, but the domain name closely resembles a legitimate cryptocurrency exchange service, suggesting an intent to deceive users into entering credentials or transferring funds.
Defenders should treat this domain as high-risk and consider blocking it at the DNS or proxy level. Further monitoring is recommended to track changes in hosting, SSL certificates, or detection status, as phishing infrastructure often shifts rapidly. No brand-specific indicators or phishing kit signatures have been confirmed at this time.