swiftferns[.]com

Analysis indicates that swiftferns.com is a credential‑phishing site that impersonates the brand “base”. The domain was registered on February 21, 2026 through OwnRegistrar, Inc., and it resolves to the IP address 172.245.14.131, which belongs to HostPapa (AS36352) in the United States. The site’s HTTPS certificate is identified as R10, and the page title returned by the server is “Swiftferns - Home”.

Security telemetry shows that two of ninety‑five VirusTotal scanners flagged the domain, suggesting that at least a small subset of anti‑malware engines detected malicious characteristics. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low confidence rating. The domain appears on a single security blocklist and has been taken offline, with the takedown attributed to the PhishDestroy blocking service.

Current evidence does not reveal the specific content of the landing page, the exact phishing kit used, or the presence of additional command‑and‑control infrastructure. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any residual traffic to 172.245.14.131, and ensure that any credential‑capture attempts targeting the “base” brand are flagged in email and web filtering solutions. Further investigation is recommended to capture any cached page snapshots, assess whether the site was serving credential‑stealing forms, and to verify if related domains share the same hosting or registrar footprint.