swissborg-vault[.]pages[.]dev

Analysis of swissborg-vault.pages.dev shows a high‑risk phishing indicator. The domain is currently blocked by the PhishDestroy feed, confirming that security operators have observed malicious activity tied to the name. Google Safe Browsing classifies the site under social engineering, reinforcing the phishing assessment. VirusTotal reports that 15 out of 91 scanned security vendors flag the domain, demonstrating a notable consensus among detection engines that the site hosts malicious content.

The domain appears on a single external blocklist, adding another layer of community‑driven reputation data. Infrastructure inspection reveals the domain is hosted on Cloudflare, Inc., as indicated by the registrar information and the authoritative nameservers mario.ns.cloudflare.com and rihana.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.108, an address owned by Cloudflare's global edge network, which is commonly used for fast content delivery but also frequently leveraged by threat actors to hide behind reputable infrastructure.

No public page title or content analysis is available at this time, so the exact visual or functional characteristics of the landing page remain unknown. Defenders should continue to block the domain at perimeter filters, update endpoint URL blacklists with the observed IP and host, and monitor for any new indicators that may arise from deeper content inspection. Given the combination of vendor detections, Safe Browsing flag, and active blocklist entry, the domain should be treated as a confirmed phishing source until further forensic evidence is gathered.