swell-25[.]com

The domain swell-25.com was registered on November 04, 2025 through Dominet (HK) Limited and currently resolves to the IP address 188.114.96.3, which is part of the Cloudflare network (AS13335) located in the United States. No SSL certificate is associated with the domain, indicating that any HTTP communication would be unencrypted. The authoritative nameservers are blakely.ns.cloudflare.com and tom.ns.cloudflare.com, both Cloudflare‑managed, which is consistent with the observed hosting. The site returned an HTTP 404 status with the page title "404 Not Found" before being taken offline, suggesting that any malicious content that may have existed is no longer reachable. Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, reinforcing the assessment of a malicious or low‑reputation asset.

Reputation services have flagged the domain: it appears on one security blocklist, is listed by PhishDestroy, and received 15 positive detections out of 95 antivirus engines on VirusTotal. The cumulative evidence points to the domain being used for generic phishing activity, although the exact phishing campaign details, target brands, or lure techniques have not been disclosed in the available intelligence. The offline status limits direct observation of payloads, but the combination of blocklist inclusion, multiple vendor detections, a zero trust score, and lack of TLS makes the domain a high‑confidence indicator of phishing risk.

Defenders should continue to block swell-25.com at the DNS and URL filtering layers, monitor for any re‑registration or changes in hosting, and correlate any internal alerts that reference the IP 188.114.96.3 with this domain. Given the Cloudflare hosting, additional scrutiny of traffic patterns to the address may be warranted to detect potential reuse by other malicious actors.