active[.]swiftexchange[.]live

The domain active.swiftexchange.live is identified as a brand impersonation threat specifically targeting Across, a known financial or transactional service platform. Analysis indicates the site was designed to mimic SwiftExchange, likely to deceive users into submitting sensitive information or conducting fraudulent transactions. As of the latest assessment, the domain has been taken offline, though prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered through the autonomous system ASN: 36352 (CC-198-23-193-168-29) and resolved to the IP address 198.23.193.170. Security vendors on VirusTotal flagged the domain, with 14 out of 95 engines detecting malicious indicators. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, reinforcing its high-risk classification. Technical artifacts include the use of Cloudflare, Let’s Encrypt SSL certificates, and third-party integrations such as Trustpilot and Smartsupp, which are often leveraged to enhance perceived legitimacy. Given the domain’s current offline status, immediate interaction risks are mitigated. However, users and organizations should remain vigilant, as similar impersonation domains may resurface under different names or infrastructure. It is recommended to monitor for newly registered domains associated with Across or SwiftExchange, implement DNS-based blocking for known malicious IPs (e.g., 198.23.193.170), and verify SSL certificates against trusted issuers. Security teams should also review logs for prior connections to this domain or its associated IP to assess potential exposure.