swaplevoraopt[.]live

The domain swaplevoraopt.live is actively impersonating a legitimate AI-assisted trading platform, as indicated by its page title 'Swap Levora Opt | Official Platform for AI Assisted Trading.' Registered on May 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 104.21.57.217. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside additional technologies such as jsDelivr, jQuery, and IPinfo. The presence of HSTS suggests an attempt to appear legitimate by enforcing secure connections, though the SSL certificate is issued by Let's Encrypt, a common choice for both benign and malicious domains. Threat intelligence sources indicate significant detection of this domain. AlienVault OTX records its inclusion in 14 threat intelligence pulses, while 11 out of 95 security vendors on VirusTotal flag the domain as malicious. It is currently blocked by at least two security blocklists, including PhishDestroy and BLP-Malware. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk. Despite these indicators, the domain remains active as of July 12, 2026, posing an ongoing threat. The domain's impersonation of an AI trading platform suggests a likely phishing campaign targeting users seeking automated financial services. The use of Cloudflare infrastructure may complicate takedown efforts and obscure the true origin of the malicious activity. Defenders should prioritize blocking the domain and its resolving IP address at the network level. Monitoring for connections to 104.21.57.217 or requests to swaplevoraopt.live can aid in identifying compromised systems within an environment. Given the domain's recent registration and active status, continued vigilance is warranted, particularly in sectors where AI-driven trading platforms are prevalent.