adrianstore[.]com[.]co

Analysis of adrianstore.com.co indicates a high-risk phishing operation targeting SwissPass credentials. The domain, registered on October 2, 2014, currently resolves to IP 50.31.174.169 and displays a page titled 'Login | SwissPass,' suggesting an attempt to harvest login details for the SwissPass platform. Infrastructure analysis reveals the use of WordPress, PHP, MySQL, and Cloudflare, alongside additional technologies such as Yoast SEO and Swiper, which may be leveraged to enhance the site's legitimacy or evade detection. The domain is flagged by 5 security vendors on VirusTotal and appears in 14 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. It is currently listed on two security blocklists, including PhishDestroy and BLP-Malware. The SSL certificate is issued by Let's Encrypt, a common tactic to create a false sense of security for potential victims. Despite its long registration history, the domain remains active and continues to pose a threat. Defenders should treat this domain as a confirmed phishing site and prioritize blocking or monitoring traffic to and from 50.31.174.169. Given the presence of Cloudflare, additional scrutiny of related domains or IPs within the same infrastructure may be warranted. No specific phishing kit or additional brand impersonation details are currently available, but the page title provides clear evidence of the intended target. Immediate action is recommended to mitigate credential theft risks associated with this site.