swiftresolvernode[.]site

Analysis indicates that swiftresolvernode.site was registered on 24 September 2025 through Global Domain Group LLC and uses the authoritative name servers ns1.host-forest.com and ns2.host-forest.com. The domain resolves to the IPv4 address 198.23.156.130, which belongs to AS36352 operated by HostPapa in the United States. No TLS certificate is presented; the site is reachable only via HTTP, and current status is marked offline, suggesting the hosting service has been taken down or the server is no longer responding. The page title returned by the last known HTTP request is “Home | Dapps Leading Synthetic Protocol,” which does not reference the targeted brand but aligns with the “Wallet/Seed Phishing” classification. The underlying phishing kit is identified as “Wallet Connect Abuse,” a known module used to harvest private keys and seed phrases. The campaign impersonates the decentralized exchange aggregator 1inch, a brand explicitly listed in the intelligence.

Reputation services flag the domain heavily. It appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scans show that 13 of 95 AV engines label the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, confirming a lack of confidence in its legitimacy. The combination of blocklist presence, multiple vendor detections, and a zero trust score places the domain in the high‑risk category. Uncertainties remain regarding the current accessibility of the site; the “offline” status may be temporary, and the HTTP response body has not been captured in the provided data.

No SSL certificate means encrypted traffic cannot be inspected, and any future re‑activation would occur over clear‑text HTTP, facilitating credential interception. Defenders should immediately add swiftresolvernode.site and its resolving IP 198.23.156.130 to deny lists across network perimeter and endpoint controls.