swiftwealthsfinance[.]com

The domain swiftwealthsfinance.com has been identified as a fraudulent banking portal designed to impersonate SwiftWealth, a legitimate financial institution. Analysis indicates this is a credential harvesting operation, presenting itself as a login interface under the page title 'SwiftWealthFinance- Your New Favorite Bank.' The site is currently offline, though its infrastructure remains a documented threat vector for financial phishing campaigns. Infrastructure analysis reveals the domain was registered through Global Domain Group LLC on February 21, 2026, an unusual future-dated registration that may indicate domain spoofing or backdating. It resolves to the IP address 92.113.23.167 and employs a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics show the domain is flagged by 12 of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a confirmed phishing resource. Current risk assessment categorizes this as an elevated threat due to its direct targeting of financial credentials and the use of brand impersonation tactics. While the site is presently offline, historical data suggests it may resurface under altered infrastructure or related domains. Organizations and users are advised to block the domain and associated IP at the network perimeter, monitor for similar registrations under the same registrar, and implement multi-factor authentication for all financial accounts. Endpoint protection systems should be updated to include this domain in phishing signature databases, and security teams should conduct retrospective log analysis to identify any prior exposure.