--- title: "Is gho-swap.com a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "gho-swap.com" verdict: "Critical Risk" title: "Is gho-swap.com a Scam? Risk Report, Score 0/100" trust_score: 0 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/gho-swap.com assessed: 2026-10-27 --- # Is gho-swap.com a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** gho-swap.com shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk Assessed 2026-10-27 by automated analysis. Classification confidence 75%. ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 4 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 11% confidence (AbuseIPDB, 5 reports; shared hosting inflates reports) | Clear | | Domain age | 3 months old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (1 snapshot) | Clear | | Certificate | Encrypted connection (Issued by YR1) | Noted | ## The page as captured ![Screenshot of the gho-swap.com homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/gho-swap.com/screenshots/first.png) _What gho-swap.com served when TrustSniffer captured it on 2026-10-27. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Overview GHO Swap is a newly launched website presenting itself as a decentralized-exchange platform for EVM-compatible blockchains. Its homepage is titled as the "#1 EVM DEX" and advertises precision token swaps, liquidity pools, staking and an airdrop. The apparent business model is a token-trading and yield-participation front end, aimed at visitors who would connect crypto assets to the service. ### Scam/Impersonation Risk Material contradictions are present, and the posture is cautionary. Multiple independent security engines currently flag the domain as malicious (four malicious, one suspicious), and an external reputation source records it as **blacklisted**. A site whose only visible offering is a crypto-asset swap, pooling, staking and airdrop interface is exactly the kind of destination where a malicious flag is most consequential. Airdrop and staking prompts are a common lure for asset-approval or seed-phrase theft, and the homepage's "#1 EVM DEX" ranking is an unverifiable superlative with no supporting data. The domain's very recent creation compounds this, since there is no history that could offset the detections. The hosting address also has a small number of abuse reports (five). These relate to a shared data-centre address and cannot be attributed to this site alone, so they are a secondary reputational signal. Automated behavioral testing did not observe wallet-drainer activity, clipboard manipulation, hidden forms or credential posts to outside parties. That is a mitigating observation, but it does not offset the current malicious detections. No conflicting legal entities were found, so no identity contradiction exists. Evidence: - Homepage: titled "GHO Swap — #1 EVM DEX | Precision Swap, Pool, Stake & Airdrop", a superlative claim with no substantiation. - Domain registration: registered 2026-07-31 (~0.24 years, about 88 days old), with registration running to 2027-07-31. - Web archive: 1 snapshot, captured 2026-08-05, covering 1 year tracked, so there is no meaningful operating history. - Reputation checks: 4 malicious and 1 suspicious detections, plus a confirmed external blacklist entry; the hosting address carries 5 abuse reports, attributed to shared infrastructure. - Behavioral sessions: 3 of 3 runs succeeded with no wallet-drainer, clipboard-hijack, hidden-form or external password-form activity. ### Regulatory Verification Notes The homepage was captured and carries substantial text, but the page content was not independently analysed. The real-world operator therefore remains unconfirmed, and the evidence does not connect the site to any identifiable company, registrant of record or regulatory authorisation. The domain registration carries only generic administrative placeholders, which are not a basis for attributing the site to any party. The platform offers swapping, pooled liquidity and staking, and such activity commonly falls under financial-services or virtual-asset regulation depending on jurisdiction. The site's regulatory standing for that activity has not been established, and no third-party broker-reputation profile matches the domain. This is a verification gap, but the decisive concern remains the external threat detections described above. Evidence: - Domain registration: handled through the registrar Atak Domain, with a generic administrator name and a registrant label that merely repeats the domain name. - Hosting: served from AS59692 (IQWeb FZ-LLC, United Arab Emirates), while the address registry is European, a geographic mismatch. - Transport encryption: TLS certificate issued by YR1 (DV, domain validation only), valid to 2027-01-20; this confirms an encrypted connection, not the operator's identity. - DeFi directories: the project is not recognised in public DeFi protocol listings, so no TVL figure can be cited. ### What to Verify Next Before any engagement, the site's malicious flags should be re-checked against current threat-intelligence sources, since a clean re-evaluation is the only development that would change this assessment. Any claim to be an official or recognised exchange should be tested against the project's official channels, reached through an independently sourced route rather than links on this site. The operator's legal identity and any authorisation to offer trading or staking should be confirmed with the relevant financial regulator or registry. The official contact channels should also be confirmed independently. Any smart-contract addresses the site presents should be cross-checked on a public blockchain explorer, and the claimed "airdrop" should be treated as unverified until the issuing project confirms it. Evidence: - Homepage: advertises an airdrop and staking, which are claims that require external confirmation. - Domain age: under three months, so no long-standing track record exists to rely on. - Reputation: currently active malicious detections, which should be re-queried before any decision. ### Summary Verdict The available evidence places this website in an elevated-risk category. Active malicious detections and a confirmed external blacklist entry, combined with a very young domain, an absence of operating history and an unestablished operator identity, outweigh the technically valid encryption and the benign behavior observed in testing. It cannot be treated as a legitimate or trustworthy service on current evidence. ### Infrastructure Integrity The site is served from a single data-centre address at IQWeb FZ-LLC in the United Arab Emirates, with no content-delivery network or web-application firewall in front of it. That leaves no protective layer to mitigate the reputation risk, and the origin server is directly exposed. The address belongs to a shared hosting range, and the geographic mismatch with the registry and the sparse young-domain footprint are unconfirmed heuristics that add no independent weight beyond the verdict. ### Closing Assessment The site should be limited to passive, read-only viewing at most. No wallet should be connected and no transaction or token approval signed. No login should be attempted, no credentials entered, and no funds committed unless the external detections are cleared and the operator is independently verified. _Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 4 findings contributed to this verdict, raised by external reputation, history in the web archive, behaviour in a sandbox, hosting and network. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### 03 Behaviour in a sandbox - Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`) ### 04 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) - The hosting and network setup shows a moderate level of risk indicators. (Hosting and network `rule:DNS_RISK_MED`) - The domain is young and has almost nothing else set up around it. (Hosting and network `rule:DNS_SPARSE_YOUNG_DOMAIN`) ### Signals weighed against the site - AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNKNOWN | | Identity score | 50/100 | | Identity verification confidence | 30% | - AI page analysis unavailable (page captured; identity not AI-verified) _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of gho-swap.com. - The request stayed on gho-swap.com. It was not redirected to another domain. (Clear) - Registration is published under Atak Domain. (Clear) - DNS for this domain is served by trustname.com, across 2 name servers. (Noted) - The registration is paid up to 2027-07-31. (Noted) - The earliest public archive of this site is from 2026-08-05. (Clear) - It is hosted on IQWEB, from a server in AE. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Atak Domain | | Hosting | IQWEB - IQWeb FZ-LLC, AE | | Country | AE | | Server IP | 186.2.175.35 | | Name servers | ARES.TRUSTNAME.COM, ZEUS.TRUSTNAME.COM | | CDN / edge network | Not detected | | Resolved IP addresses | 1 | | Edge IP addresses | 0 | | Likely origin IP addresses | 1 | | SSL issuer | YR1 | | SSL expiry | 2027-01-20 | | Domain age | 0.24 years (continuous registration) | | Domain expiry | 2027-07-31 | | Archive first seen | 2026-08-05 | | Archive snapshots | 1 | | Reputation | VirusTotal: 4 flagged \| AbuseIPDB: 11% confidence, 5 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about gho-swap.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [pitadacriativa.com](https://trustsniffer.com/report/pitadacriativa.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [cikgujoyce.com](https://trustsniffer.com/report/cikgujoyce.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [anastasiapierce.com](https://trustsniffer.com/report/anastasiapierce.com), another .com site assessed as critical-risk (Critical Risk, 5/100) - [echargejo.com](https://trustsniffer.com/report/echargejo.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [jvasonline.com](https://trustsniffer.com/report/jvasonline.com), another .com site assessed as critical-risk (Critical Risk, 5/100) - [multilatinomarketing.com](https://trustsniffer.com/report/multilatinomarketing.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [optionstraderx.com](https://trustsniffer.com/report/optionstraderx.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [aguamais.com](https://trustsniffer.com/report/aguamais.com), another .com site assessed as critical-risk (Critical Risk, 0/100) - [portal-moonshot-tn0.netlify.app](https://trustsniffer.com/report/portal-moonshot-tn0.netlify.app), another site assessed as critical-risk (Critical Risk, 0/100) - [thoreum-capital.pages.dev](https://trustsniffer.com/report/thoreum-capital.pages.dev), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [No Age Distribution Yet for Suspicious Websites](https://trustsniffer.com/blog/no-age-distribution-suspicious-websites) - [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site) - [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26) --- *Source: [TrustSniffer](https://trustsniffer.com/report/gho-swap.com) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/gho-swap.com · assessed 2026-10-27.*