swftabanking[.]cfd

This domain, swftabanking.cfd, operates as a fraudulent banking portal designed to harvest login credentials for Swift Banking accounts. Analysis indicates the site replicates legitimate banking interfaces to deceive users into entering sensitive financial details, including usernames, passwords, and multi-factor authentication codes. The threat extends to potential account takeover, unauthorized transactions, and identity theft, targeting both retail and corporate banking customers. Technical indicators confirm the malicious nature of this domain. VirusTotal reports 14 out of 95 security vendors flagging swftabanking.cfd as malicious, with detection labels including phishing and credential theft. The domain was registered on June 02, 2026, through OwnRegistrar, Inc., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals resolution to IP address 198.251.84.200, a hosting provider commonly used for phishing campaigns. The domain appears on one security blocklist, and technologies detected include PHP, Tailwind CSS, and Alpine.js, which are often leveraged to create convincing fake login pages. The use of HTTP/3 and LiteSpeed suggests an attempt to evade detection and improve page load performance for unsuspecting victims. Users who visited swftabanking.cfd or entered credentials on the site should take immediate action to mitigate risk. First, terminate any active sessions on the fraudulent site and avoid further interaction. Reset passwords for Swift Banking accounts and any other services where the same credentials may have been reused. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor financial accounts for unauthorized transactions and report suspicious activity to the legitimate financial institution. Additionally, scan local devices for malware, as phishing sites may deploy malicious scripts or redirect to exploit kits. Consider freezing credit reports to prevent identity theft if personal or financial information was disclosed.