swepauth[.]com

The domain swepauth.com has been identified as a high-risk fake authentication portal designed to harvest user credentials. Analysis indicates this infrastructure is currently offline but was actively engaged in social engineering tactics, as confirmed by its classification under generic phishing. No specific brand impersonation has been conclusively linked to this domain; however, the presence of an invalid SSL certificate (error 526) suggests an attempt to mimic legitimate authentication flows while evading detection. Infrastructure analysis reveals that swepauth.com was registered through Global Domain Group LLC on February 24, 2026, and resolved to the IP address 104.21.22.196, utilizing Cloudflare and HTTP/3 technologies. The domain appears on two security blocklists and is flagged by 16 of 95 security vendors on VirusTotal, with additional detection in one AlienVault OTX threat intelligence pulse. Google Safe Browsing has explicitly marked this domain under the SOCIAL_ENGINEERING category, reinforcing its malicious intent. The SSL certificate, issued by Let’s Encrypt, was invalid at the time of assessment, further degrading its apparent legitimacy. As of the latest verification, swepauth.com has been taken offline, though residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations are advised to block the domain and its associated IP address (104.21.22.196) at the network perimeter. Security teams should review logs for connections to this domain, particularly those involving credential submission attempts. End-users who may have entered credentials on this portal should initiate password resets for affected accounts and enable multi-factor authentication where available. Continuous monitoring for related infrastructure is recommended, given the domain’s recent registration and rapid inclusion in threat intelligence feeds.