swiftlinknexora[.]net

The domain swiftlinknexora.net was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.137.247, which belongs to the Cloudflare network (ASN 13335) and is geolocated in the United States. The site is currently offline, and no TLS certificate was observed, indicating that HTTPS connections are not available. The page title returned when the site was reachable was “Swiftlink Nexora - Official Platform | AI Trading 2025 | Over 10,000 Reviews”, and the domain is explicitly listed as impersonating the cryptocurrency exchange Binance. The domain appears on one security blocklist and has been flagged by the PhishDestroy sinkhole.

A Gridinsoft trust score of 0 out of 100 further confirms a malicious reputation. VirusTotal analysis shows that one of ninety‑three scanning engines flagged the domain, although the specific engine and detection type were not disclosed. Nameserver records point to augustus.ns.cloudflare.com and kira.ns.cloudflare.com, both standard Cloudflare authoritative servers. Evidence suggests that the infrastructure is deliberately hosted behind Cloudflare to hide the origin server and to benefit from the provider’s global CDN. The lack of an SSL certificate and the offline status reduce immediate exposure, but the presence of a brand‑impersonation page title indicates that the domain was likely used for a Binance‑related phishing campaign.

The exact content of the landing page, credential‑stealing mechanisms, or any associated malicious payloads have not been publicly documented, leaving the full attack vector uncertain. Defenders should add swiftlinknexora.net to domain blocklists, monitor DNS queries for the associated Cloudflare IP range, and enforce strict email and web filtering for any communications referencing Binance login URLs.