dashboard-swarmnode[.]xyz

dashboard-swarmnode.xyz was registered through Dynadot LLC on March 26, 2026. The domain is currently active and classified as a high‑risk generic phishing operation. Its creation timestamp places it within the last four months, aligning with other recent streaming‑related scams observed in the threat landscape. Network analysis shows the domain resolves to the Cloudflare‑owned address 172.67.193.211, which is geolocated to Canada. Cloudflare’s authoritative name servers, byron.ns.cloudflare.com and novalee.ns.cloudflare.com, are listed in the DNS records. The site presents an HTTP 403 response and serves a valid Let’s Encrypt certificate (E8 series), indicating that the infrastructure is deliberately configured to appear legitimate while denying direct content access. Threat intelligence sources corroborate malicious intent. VirusTotal has flagged the domain in 4 of 95 scanned security vendors, and AlienVault OTX references the domain in a single threat pulse. The domain appears on one public blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting extreme suspicion. PhishDestroy has already blocked the domain, and the associated scam has been identified as a streaming scam, consistent with the "generic_phishing" label. Defenders should prioritize immediate containment. Blocking DNS resolution for dashboard-swarmnode.xyz and the associated IP 172.67.193.211 will prevent end‑user exposure. Security appliances should be updated to include the domain in URL filtering rules, and any existing network logs should be searched for prior connections to the IP address. Continuous monitoring of newly registered domains that share the same registrar or name‑server patterns is advised to catch similar campaigns early.