swassabers[.]com

This domain, swassabers.com, is currently active and poses a high-risk credential harvesting threat targeting users through deceptive promotional offers. The site displays a page titled 'SWA Sabers - Buy 1 Get 2 Free,' a common tactic used to lure victims into entering sensitive information such as login credentials, payment details, or personal data under false pretenses. Such phishing pages often mimic legitimate retailers or service providers to exploit user trust and urgency created by limited-time offers. Analysis indicates the domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with newly created malicious domains. The domain resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services, which may create a false sense of security for users. Despite the presence of encryption, only 1 out of 95 security vendors on VirusTotal currently flag the domain as malicious, suggesting either limited detection at this stage or evasion techniques employed by the threat actors. Users who have visited swassabers.com or entered any information on the site should take immediate action. First, disconnect the device from the network to prevent potential data exfiltration. Change passwords for any accounts accessed from the same device, especially those related to financial services or email. Enable multi-factor authentication where available. Monitor financial statements for unauthorized transactions and consider placing a fraud alert with credit bureaus. It is also recommended to scan the device using updated security tools to detect and remove any malware that may have been installed during the interaction.