cybershwke[.]com

This domain, cybershwke.com, is flagged as a generic phishing threat designed to harvest user credentials through fake login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with broad credential-theft campaigns. The domain exhibits characteristics typical of phishing operations, including deceptive subdomains and cloned authentication interfaces, though no explicit brand impersonation has been confirmed in available telemetry. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 172.67.184.235, a shared hosting node frequently observed in malicious campaigns. It was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar commonly used for short-lived phishing domains. VirusTotal detection shows 12 of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. Google Safe Browsing status is not explicitly noted, but the combination of low vendor detection and blocklist presence suggests targeted or emerging threats. The domain is currently offline, likely due to takedown actions or infrastructure rotation. It was blocked by PhishDestroy, indicating automated or manual intervention. Despite its offline status, residual risk remains for users who may have interacted with the domain during its active window. Organizations should monitor for related indicators, including the associated IP and registrar patterns, and update detection rules to account for potential successor domains. Users are advised to verify login portals via official sources and report any suspicious activity involving this domain or its infrastructure.