swiftblocklayer[.]xyz

The domain swiftblocklayer.xyz was registered on 17 October 2025 through OwnRegistrar, Inc. and is currently listed as offline. DNS resolution points to IP address 172.67.188.117, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The domain does not present an SSL/TLS certificate, indicating that any HTTP service would have been delivered over cleartext. A page title retrieved when the site was live read "Pieni hetki..."; no further content analysis is available.

Reputation data shows a Gridinsoft trust score of 0 out of 100, suggesting an extremely low trust rating. VirusTotal scans recorded eight positive detections out of ninety‑five submitted security vendors, confirming that multiple anti‑malware engines have flagged the domain. The domain appears on a single external security blocklist and is actively blocked by the PhishDestroy filter. AlienVault OTX references the domain in one threat‑intel pulse, providing additional corroboration of malicious use.

Nameserver delegation uses audrey.ns.cloudflare.com and lewis.ns.cloudflare.com, consistent with Cloudflare‑provided DNS. While the domain’s current offline status limits real‑time verification, the aggregation of registration data, IP hosting, lack of TLS, low trust score, multiple vendor detections, and inclusion on blocklists collectively indicate that swiftblocklayer.xyz was employed for generic phishing activity. Defenders should continue to block the domain at network perimeter and proxy layers, monitor for any resurgence of the host IP, and update endpoint and URL filtering rules to reflect the observed detections. Further investigation of any residual traffic or related sub‑domains is recommended to fully map the associated malicious infrastructure.