Is gho-swap.com a scam? TrustSniffer's high-risk assessment: 0/100

Overview

GHO Swap is a newly launched website presenting itself as a decentralized-exchange platform for EVM-compatible blockchains. Its homepage is titled as the "#1 EVM DEX" and advertises precision token swaps, liquidity pools, staking and an airdrop. The apparent business model is a token-trading and yield-participation front end, aimed at visitors who would connect crypto assets to the service.

Scam/Impersonation Risk

Material contradictions are present, and the posture is cautionary. Multiple independent security engines currently flag the domain as malicious (four malicious, one suspicious), and an external reputation source records it as blacklisted. A site whose only visible offering is a crypto-asset swap, pooling, staking and airdrop interface is exactly the kind of destination where a malicious flag is most consequential. Airdrop and staking prompts are a common lure for asset-approval or seed-phrase theft, and the homepage's "#1 EVM DEX" ranking is an unverifiable superlative with no supporting data. The domain's very recent creation compounds this, since there is no history that could offset the detections. The hosting address also has a small number of abuse reports (five). These relate to a shared data-centre address and cannot be attributed to this site alone, so they are a secondary reputational signal. Automated behavioral testing did not observe wallet-drainer activity, clipboard manipulation, hidden forms or credential posts to outside parties. That is a mitigating observation, but it does not offset the current malicious detections. No conflicting legal entities were found, so no identity contradiction exists. Evidence:

• Homepage: titled "GHO Swap — #1 EVM DEX | Precision Swap, Pool, Stake & Airdrop", a superlative claim with no substantiation.
• Domain registration: registered 2026-07-31 (~0.24 years, about 88 days old), with registration running to 2027-07-31.
• Web archive: 1 snapshot, captured 2026-08-05, covering 1 year tracked, so there is no meaningful operating history.
• Reputation checks: 4 malicious and 1 suspicious detections, plus a confirmed external blacklist entry; the hosting address carries 5 abuse reports, attributed to shared infrastructure.
• Behavioral sessions: 3 of 3 runs succeeded with no wallet-drainer, clipboard-hijack, hidden-form or external password-form activity.

Regulatory Verification Notes

The homepage was captured and carries substantial text, but the page content was not independently analysed. The real-world operator therefore remains unconfirmed, and the evidence does not connect the site to any identifiable company, registrant of record or regulatory authorisation. The domain registration carries only generic administrative placeholders, which are not a basis for attributing the site to any party. The platform offers swapping, pooled liquidity and staking, and such activity commonly falls under financial-services or virtual-asset regulation depending on jurisdiction. The site's regulatory standing for that activity has not been established, and no third-party broker-reputation profile matches the domain. This is a verification gap, but the decisive concern remains the external threat detections described above. Evidence:

• Domain registration: handled through the registrar Atak Domain, with a generic administrator name and a registrant label that merely repeats the domain name.
• Hosting: served from AS59692 (IQWeb FZ-LLC, United Arab Emirates), while the address registry is European, a geographic mismatch.
• Transport encryption: TLS certificate issued by YR1 (DV, domain validation only), valid to 2027-01-20; this confirms an encrypted connection, not the operator's identity.
• DeFi directories: the project is not recognised in public DeFi protocol listings, so no TVL figure can be cited.

What to Verify Next

Before any engagement, the site's malicious flags should be re-checked against current threat-intelligence sources, since a clean re-evaluation is the only development that would change this assessment. Any claim to be an official or recognised exchange should be tested against the project's official channels, reached through an independently sourced route rather than links on this site. The operator's legal identity and any authorisation to offer trading or staking should be confirmed with the relevant financial regulator or registry. The official contact channels should also be confirmed independently. Any smart-contract addresses the site presents should be cross-checked on a public blockchain explorer, and the claimed "airdrop" should be treated as unverified until the issuing project confirms it. Evidence:

• Homepage: advertises an airdrop and staking, which are claims that require external confirmation.
• Domain age: under three months, so no long-standing track record exists to rely on.
• Reputation: currently active malicious detections, which should be re-queried before any decision.

Summary Verdict

The available evidence places this website in an elevated-risk category. Active malicious detections and a confirmed external blacklist entry, combined with a very young domain, an absence of operating history and an unestablished operator identity, outweigh the technically valid encryption and the benign behavior observed in testing. It cannot be treated as a legitimate or trustworthy service on current evidence.

Infrastructure Integrity

The site is served from a single data-centre address at IQWeb FZ-LLC in the United Arab Emirates, with no content-delivery network or web-application firewall in front of it. That leaves no protective layer to mitigate the reputation risk, and the origin server is directly exposed. The address belongs to a shared hosting range, and the geographic mismatch with the registry and the sparse young-domain footprint are unconfirmed heuristics that add no independent weight beyond the verdict.

Closing Assessment

The site should be limited to passive, read-only viewing at most. No wallet should be connected and no transaction or token approval signed. No login should be attempted, no credentials entered, and no funds committed unless the external detections are cleared and the operator is independently verified.

Signals weighed against the site

• AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.