swicom-dc261[.]web[.]app

This domain, swicom-dc261.web.app, is identified as a credential theft phishing site impersonating Swisscom, a major telecommunications provider. Analysis indicates the page title explicitly mimics the legitimate Swisscom login portal, suggesting a targeted campaign to harvest user credentials. No evidence of a crypto drainer kit or secondary payloads was observed, but the domain’s infrastructure and content align with credential harvesting tactics commonly used in account takeover schemes. Infrastructure analysis reveals the domain resolves to IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) with a geolocation in the United States. The domain is registered through Google LLC, utilizing an SSL certificate issued by Google Trust Services (WR4). VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. No creation date was provided, but the domain’s association with a known content delivery network suggests it may have been operational for a limited duration to evade detection. Google Safe Browsing status is not explicitly stated, but the domain’s presence on multiple blocklists indicates prior classification as a threat. The domain is currently offline, likely following takedown actions or automated suspension by the hosting provider. Despite its inactive status, residual risk remains due to the potential reuse of harvested credentials in follow-on attacks, including unauthorized account access or lateral movement within compromised networks. Organizations are advised to monitor for authentication attempts using credentials tied to Swisscom services and implement multi-factor authentication to mitigate credential reuse risks. Users who interacted with this domain should reset passwords immediately and review account activity for unauthorized access.