swiftsinternationalbank[.]com

This domain, swiftsinternationalbank.com, is actively flagged as a high-risk phishing site targeting banking customers. Infrastructure analysis reveals the domain was registered on May 13, 2026, through Sav.com, LLC, and currently resolves to the IP address 198.251.84.200, hosted by FranTech Solutions in Luxembourg. The site uses nameservers ns5.asurahosting.com and ns6.asurahosting.com and presents a page title of 'Swift International Bank,' indicating an attempt to impersonate a legitimate financial institution. One of 92 security vendors on VirusTotal has detected this domain as malicious, and it appears on at least one security blocklist. The domain is also referenced in a threat intelligence pulse on AlienVault OTX, further corroborating its association with phishing activity. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. The HTTP response status is 302, which may suggest redirection to another malicious or credential-harvesting page, though the exact content and functionality of the site remain unconfirmed. Defenders should treat this domain as part of an active phishing campaign. The registration date, hosting provider, and nameserver configuration align with known patterns of phishing infrastructure. Blocking the domain and its associated IP address (198.251.84.200) at the network level is recommended. Additionally, monitoring for related domains registered through the same registrar or using similar nameserver patterns may help identify further threats. The site's low Gridinsoft trust score (3/100) and inclusion on PhishDestroy's blocklist provide further justification for immediate mitigation actions.