swisborg-lgn[.]webflow[.]io

This domain, swisborg-lgn.webflow.io, poses a direct threat as a fraudulent login portal impersonating SwissBorg, a legitimate cryptocurrency wealth management platform. Analysis indicates the page is designed to harvest user credentials by mimicking the authentic SwissBorg login interface, as evidenced by the page title 'SwissBorg | Login.' Such attacks typically target users seeking to access their crypto assets, leading to unauthorized account access, fund theft, or further exploitation through social engineering tactics. The domain exhibits characteristics consistent with credential phishing, a common precursor to financial fraud in the cryptocurrency sector. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on April 15, 2026, through Webflow, a platform frequently abused for hosting phishing pages due to its ease of deployment and low cost. VirusTotal detections show 18 out of 95 security vendors flagging the domain as malicious, a significant ratio for a newly created domain. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), resolves to the IP address 172.64.151.8, which is associated with Cloudflare, Inc., a common proxy service used to obfuscate the true origin of phishing infrastructure. Users who visited swisborg-lgn.webflow.io or entered credentials on this page should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were submitted, users must change their SwissBorg account password immediately and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or suspicious activity, and report any anomalies to the legitimate platform. Additionally, scan the device used to access the domain for malware, as phishing pages may deploy additional payloads. Finally, consider reporting the incident to relevant cybersecurity authorities or the legitimate service provider to aid in broader threat mitigation efforts.