swisborg-llogiin[.]webflow[.]io

Analysis of the domain swisborg-llogiin.webflow.io indicates a phishing site targeting users of the SwissBorg cryptocurrency platform. The domain was registered on February 27, 2026, through MarkMonitor, Inc., and hosted on Cloudflare infrastructure, resolving to IP 172.64.151.8 (AS13335, United States). The page title, 'Buy and Sell Digital Assets | SwissBorg Login,' explicitly suggests an attempt to mimic the legitimate SwissBorg login portal. As of July 25, 2026, the domain returns an HTTP 404 status, confirming it is offline, though it remains flagged by one security blocklist and detected by 19 of 93 security vendors on VirusTotal.

The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, offering no conclusive indication of intent. Technologies detected include Cloudflare and HTTP/3, consistent with modern phishing infrastructure. While the exact content of the phishing page is not analyzed, the page title and domain structure strongly imply a credential-harvesting scheme. Defenders should treat this domain as compromised and maintain blocks, as reactivation remains possible.

No evidence of associated malware or secondary payloads is present in the available data. The domain's use of Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) aligns with observed tactics to evade takedowns. Given the elevated risk level and explicit targeting of a cryptocurrency brand, organizations should monitor for related domains or IPs and ensure endpoint protection systems are updated to recognize this threat.