What Gridinsoft observed on safeswapglobal.online
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260831001849-bf27fff5
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review did not reproduce a technical or behavioral basis for a Cryptocurrency Scam classification on safeswapglobal.online. The reviewed domain operated as a disclosed affiliate directory that handed exchange actions to FixedFloat and did not itself collect credentials, wallet secrets, destination addresses, or payments. Current external blacklist labels remain contradictory context, but no exact malicious URL, payload, file, hash, or harmful on-domain flow was identified in the reviewed scope.
Analyst findings
Review 6 documented observations View evidence
The root page, about page, identity manifest, privacy and terms pages, city directory, and a distributed sample of city and currency-pair pages returned the expected SafeSwapGlobal directory content over HTTPS. The published sitemap contained 645 same-domain URLs; 24 reviewed pages spanning that set returned HTTP 200.
-
HTTP status
200 -
Final URL
https://safeswapglobal.online/ - Page element The reviewed pages consistently described an independent non-custodial routing directory and disclosed the FixedFloat relationship.
- Analyst observation The reviewed sitemap entries used the safeswapglobal.online origin; no user-upload or tenant namespace was identified.
The reviewed client-side routing logic calculates a display amount and sets the exchange call-to-action to an ff.io currency-pair URL with a disclosed referral parameter. Opening the reviewed BTC-to-XMR target returned the FixedFloat exchange page over HTTPS; SafeSwapGlobal did not receive a wallet address or transaction in this flow.
- Page element The call-to-action target used the documented https://ff.io/btc/xmr/ path and included amount and referral parameters.
-
Redirect destination
https://ff.io/btc/xmr/ -
HTTP status
200 - Analyst observation No transaction, wallet address, credential, form, or payment was submitted.
The reviewed SafeSwapGlobal pages contained no login form, password field, wallet-address field, seed phrase or private-key prompt, embedded exchange form, automatic download, executable or archive reference, unrelated redirect, or observed malware object.
- Analyst observation The root and 23 sampled sitemap pages contained zero forms, zero password inputs, zero wallet or secret inputs, and zero executable or archive references.
- Analyst observation No exact malicious URL, payload, downloaded file, or sample hash was recovered from the reviewed public flow.
The about page and machine-readable manifest published the same Ed25519 OpenPGP fingerprint. The embedded public key was valid and carried the domain support address. This proves consistency of the self-published key material, but it is not independent verification of a legal entity or transaction history.
- Page element OpenPGP fingerprint A6D4F9B6F875EC414715367A60040115CE930C82
- Public artifact URL https://safeswapglobal.online/.well-known/safeswapglobal-identity.json
- Analyst observation The public repository contained a small MIT-licensed demonstration generator and identity manifest rather than the full deployed production source.
The reviewed page loaded rate data from a Cloudflare Worker and CryptoCompare and included Cloudflare browser analytics. These services did not expose a credential receiver or transaction endpoint on the SafeSwapGlobal origin, but the analytics and third-party requests should be described precisely in privacy statements.
- Page element Rate endpoint https://ff-rates-proxy.crazy-zyr.workers.dev returned application/xml data.
- Page element The page referenced CryptoCompare price data and Cloudflare browser analytics.
- Analyst observation No reviewed request sent a wallet address, seed phrase, private key, login credential, or payment information to the SafeSwapGlobal origin.
The domain resolved through Cloudflare and served a currently valid certificate for safeswapglobal.online. HTTP navigation converged on the expected HTTPS origin without an unrelated destination.
- DNS fact Authoritative nameservers were emerson.ns.cloudflare.com and sloan.ns.cloudflare.com.
- Certificate fact Certificate subject and subject alternative name covered safeswapglobal.online; the observed validity period was 2026-08-11 through 2026-11-09.
-
Final URL
https://safeswapglobal.online/
Scope and limitations
- No cryptocurrency transaction, wallet-address submission, account login, form submission, payment, or customer-support interaction was performed.
- The review covered the root, key policy and identity pages, the 645-URL sitemap structure, and 24 distributed page samples; it was not an exhaustive request of every listed URL or hidden path.
- The review did not verify legal incorporation, beneficial ownership, financial licensing, customer outcomes, referral settlement, transaction fulfillment, or the operational controls of FixedFloat.
- The PGP key and identity manifest are self-published consistency evidence and do not independently prove a real-world legal identity.
- Public urlscan detail records required authentication, Wayback snapshot bodies returned a temporary service error, URLhaus and ThreatFox APIs required authorization, and Common Crawl and certificate-transparency queries were unavailable; unavailable sources were not treated as clean.
- The result applies to the public content, routes, redirects, and scripts reviewed at the recorded time; infrastructure and content can change.
Help protect others by sharing this page on social media! The more people who know about safeswapglobal.online, the fewer chances they have to deceive someone else. Help others evaluate safeswapglobal.online by sharing this page on social media!