new[.]eduswift[.]net

Analysis indicates that the domain new.eduswift.net is linked to a high‑risk generic phishing operation. The site presents the page title “EduSwift | School Management System”, suggesting an attempt to impersonate an educational management platform. DNS resolution points to IP 163.61.188.5, hosted in the United States under ASN 153568 (NEW DHAKA HARDWARE). The certificate is issued by Let’s Encrypt (R13), and the HTTP response returns status 200. Registration data shows the domain was created on 21 February 2026 via NameCheap, Inc., and it uses four authoritative nameservers (dns1‑dns4.eduswift.net). Infrastructure fingerprinting reveals the presence of Skilldo, Botble CMS, MySQL, PHP, Laravel, Bootstrap, LiteSpeed, and jQuery, a stack commonly observed in credential‑harvesting sites. Threat intelligence feeds list the domain on one security blocklist and it is actively blocked by PhishDestroy. VirusTotal reports a single detection out of 93 scanning engines, while Gridinsoft assigns a trust score of 0 / 100, indicating a strong malicious reputation. The combination of recent registration, active hosting, low trust scores, and limited but positive detections suggests the domain is being used to harvest login credentials or other sensitive information. Content beyond the page title has not been publicly analysed, leaving the exact phishing payload unknown. Defenders should add the domain and its IP address to outbound filtering rules, monitor DNS queries for the listed nameservers, and consider sink‑holing the IP. Continuous re‑scanning and correlation with credential‑leak databases are advised to confirm exploitation activity.