swiftcargo[.]xyz

Analysis indicates that the domain swiftcargo.xyz was registered on May 14, 2026 through Cosmotown Inc and is currently active. The domain resolves to the Cloudflare address 188.114.97.3, which is geolocated to Canada and is served by the nameservers mona.ns.cloudflare.com and stan.ns.cloudflare.com. An MX record with priority 0 points to _dc-mx.0ea0acafd0fc.swiftcargo.xyz, suggesting a deliberately configured mail endpoint that may be used to receive victim responses. The site presents an HTTP 200 response and serves a page titled "Home | Page" under a Google Trust Services / WE1 TLS certificate, confirming a valid SSL handshake despite the malicious intent.

Technical indicators show that swiftcargo.xyz has been flagged by three of ninety‑five VirusTotal scanners, appears on one public security blocklist, and received a Gridinsoft trust score of 1 out of 100, reflecting a high likelihood of abuse. The domain is also listed by PhishDestroy as blocked, reinforcing the classification as a generic_phishing infrastructure. The low trust score and multiple detections align with the assigned high risk level, and the domain's recent creation date suggests a fast‑tracked deployment typical of phishing campaigns that rely on short‑lived domains to evade detection.

While the observed infrastructure confirms a phishing operation, the specific lure, credential‑stealing forms, or targeted brands remain uncertain due to the lack of publicly available payload samples. Defenders should prioritize blocking swiftcargo.xyz at DNS and proxy layers, monitor outbound connections to the associated IP address, and enforce TLS inspection to capture any credential submission. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise linked to this domain, and incident response teams should be prepared to quarantine any user accounts that may have interacted with the site.