swbio[.]cfd

Analysis of the domain swbio.cfd indicates a brand impersonation campaign targeting the Backpack brand. The domain was registered on November 04, 2025 through Web Commerce Communications Limited and is currently taken offline. Infrastructure inspection shows the domain resolves to IP address 104.21.42.206, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No SSL certificate is present, and the domain uses Cloudflare nameservers beau.ns.cloudflare.com and hazel.ns.cloudflare.com.

Reputation scoring from Gridinsoft rates the domain at 0 out of 100, reflecting a lack of trust. VirusTotal scans have resulted in three of ninety‑five security vendors flagging the domain, reinforcing the suspicion of malicious intent. The domain appears on two public blocklists and has been specifically blocked by the PhishDestroy and Enkrypt services, providing additional confirmation of its abusive nature. While the exact payload or phishing page content has not been observed, the convergence of a low trust score, multiple vendor detections, blocklist listings, and the explicit impersonation of the Backpack brand suggests a high likelihood of credential harvesting or fraud.

Defenders should update their web filtering and DNS sinkhole configurations to block swbio.cfd, monitor for any outbound connections to its IP address, and apply threat intelligence feeds that reference its associated blocklist entries. In addition, security teams should alert users of potential Backpack‑related scams and consider tightening authentication controls for any services that could be targeted by brand‑impersonation attacks. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is recommended, as threat actors often reuse this infrastructure for related campaigns.