swobit[.]io

swobit.io was observed on July 24, 2026 as an active malicious infrastructure used for generic phishing. The domain resolves to 188.114.96.3, an IP address owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. Registration records show the domain was created on July 22, 2025 through NiceNIC International Group Co., Limited. DNS resolution is handled by the Cloudflare name servers agustin.ns.cloudflare.com and leanna.ns.cloudflare.com. The site presents the page title “Un momento…”, but no further page‑content analysis is publicly available, leaving the exact phishing landing page unknown.

TLS termination is performed by a Google Trust Services certificate issued under the WE1 authority, indicating a valid HTTPS handshake. Technical fingerprints reveal the use of Cloudflare Browser Insights and support for HTTP/3. Reputation data is strongly negative: the domain appears on one public security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in three separate threat‑intel pulses.

VirusTotal scans returned three positive detections out of ninety‑five scanning engines, confirming a malicious classification. Gridinsoft assigns a trust score of 0 out of 100. Given the convergence of registration, hosting, SSL, and detection signals, defenders should treat swobit.io as a high‑confidence phishing indicator. Recommended mitigation includes adding the domain to DNS and proxy blocklists, enabling URL filtering for the associated IP range, monitoring for new domains registered with the same registrar or similar naming patterns, and sharing indicators with relevant threat‑intel communities.