simpleswap[.]ioDomain
Reported by 1 independent source · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2“The new lure used the same “docs.google.com” URL as the previous lure but was rewritten to target a different trading site — “SimpleSwap[.]io”, another cryptocurrency trading aggregator.”
Indicators reported together
named in the same reports- hxxps://docs.google[.]com/spreadsheets/d/in 1 report
- swapzone[.]ioin 1 report
- hxxps://paste[.]sh/dQfdExjo#AqjB4BBtin 1 report
- obfuscator[.]ioin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.