swerp[.]org

Analysis indicates that the domain swerp.org was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and uses the nameservers ns100.webnic.cc and ns101.webnic.cc. The domain is currently taken offline, which may be a takedown or a temporary suspension. Gridinsoft assigns it a trust score of 0/100, indicating a high confidence of malicious intent. The page title returned from the site is simply "swerp.org", providing no additional context about the targeted brand or campaign.

VirusTotal scans have recorded 12 detections out of 95 participating security vendors, confirming that multiple independent engines classify the domain as malicious. Two public blocklists, PhishDestroy and ScamSniffer, have listed the domain, and it appears on two additional security blocklists, reinforcing its reputation as a phishing resource. No further technical indicators such as IP address, ASN, geographic location, SSL certificate details, or content signatures have been disclosed, leaving those aspects unverified. Defenders should treat swerp.org as a confirmed phishing infrastructure and update network and endpoint controls to block any resolution or HTTP requests to the domain.

Email gateways should be configured to flag or quarantine messages that contain links or references to swerp.org. Since the site is offline, threat hunters can still search historical DNS records or passive DNS feeds for previous IP mappings that may reveal additional infrastructure. Continuous monitoring of the registrar WebNic.cc for new domains that reuse the same nameservers or similar registration patterns is recommended. The presence of multiple vendor detections and inclusion on reputable blocklists suggests that the domain was actively used in phishing campaigns, and any residual artifacts in logs should be investigated for potential compromise.