i[.]cbancoswift[.]com

The domain i.cbancoswift.com was registered on 2025-05-03 through OwnRegistrar, Inc. and is hosted on the Netherlands-based network AS60117 operated by Host Sailor Ltd. DNS resolution points to the IPv4 address 194.36.191.196, which is served by the nameservers ns5.nl.hostsailor.com and ns6.nl.hostsailor.com. The site presented the page title “Invest.coinage Swift” and employed a Let’s Encrypt certificate (issuer “Let’s Encrypt” with a YR1 designation), indicating that TLS was correctly configured at the time of capture. Threat-intelligence feeds have flagged the domain on three independent blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal recorded 2 detections out of 91 scanned scanners, confirming that at least two security vendors identified malicious characteristics. The Gridinsoft trust score of 0 / 100 further reinforces the low reputation of the host. According to the current status, the site has been taken offline, but historical evidence shows that the infrastructure was used for a generic phishing campaign that likely attempted to lure victims into investing in a “coinage” service tied to the Swift payment system.

The available data does not disclose the exact payload, credential-harvesting method, or any associated command-and-control infrastructure, leaving the full attack chain uncertain. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any residual traffic to 194.36.191.196, and update endpoint detection rules to include the two VirusTotal-reported signatures. Additional investigation of the hosting provider’s other domains may reveal related campaigns, and threat-hunting queries should include the page title “Invest.coinage Swift” as an indicator of compromise.