swiftexecutor[.]app

The domain swiftexecutor.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. DNS resolution is provided by ns3.my-ndns.com and ns4.my-ndns.com, and the web server stack reports Ubuntu with Nginx. An HTTP request returns a 303 status, and the page title observed is "Swift Executor - Safe And Reliable Roblox Script Execution Tool," indicating a fraudulent offering aimed at Roblox users. The intelligence tags the activity as a high‑risk, gaming‑focused generic phishing campaign. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows five of ninety‑three scanners flag the host, reinforcing the malicious assessment. No additional content analysis is available beyond the title, so the exact mechanics of the scam—such as credential harvesting or malicious payload delivery—remain uncertain. Defenders should prioritize immediate network‑level blocking of swiftexecutor.app, add the domain to internal threat‑intel feeds, and monitor related DNS queries or HTTP redirects for similar patterns. Continuous traffic inspection and endpoint alerts for attempts to access the site are recommended to mitigate potential compromise of Roblox accounts or associated credentials.