swiftrexpay[.]com

Analysis of the domain swiftrexpay.com indicates it was a phishing site targeting users of a payment or financial service, as suggested by its page title 'SwiftreXpay.' The domain was registered on March 6, 2026, through NameSilo, LLC, and resolved to the IP address 172.93.120.110, hosted under AS393960 (Host4Geeks LLC) in the United States. Infrastructure analysis reveals the domain used nameservers ns1.spantrix.com and ns2.spantrix.com, a pattern observed in other low-reputation hosting setups. At the time of assessment, the domain lacked an SSL certificate, increasing the likelihood of unencrypted data transmission, a common red flag in phishing operations. Detection data from security vendors is limited but notable: two of 95 vendors on VirusTotal flagged the domain as malicious, while three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, had already listed it.

This alignment across multiple detection sources suggests the domain was actively recognized as a threat prior to being taken offline. The absence of additional public threat intelligence, such as Open Threat Exchange (OTX) pulses or Safe Browsing warnings, limits further contextual analysis, though the available evidence supports its classification as a phishing asset. Defenders should treat swiftrexpay.com as a confirmed malicious domain. Network-level blocking of the IP 172.93.120.110 and associated nameservers is recommended to prevent residual exposure.

Organizations using threat intelligence feeds should verify whether internal logs contain connections to this domain or its infrastructure, particularly in financial or transactional contexts. Given the domain’s recent creation and rapid inclusion on blocklists, it may have been part of a short-lived campaign, emphasizing the need for real-time monitoring of newly registered domains with financial-themed naming conventions.