swiftfxbase247[.]click

The domain swiftfxbase247.click was registered on March 11, 2026 through OwnRegistrar, Inc. and currently resolves to the IP address 192.142.10.129, which is hosted in the Netherlands under AS214036 (Ultahost, Inc.). The site is offline at the time of analysis, but historical evidence shows it was flagged by multiple defenses. Google Safe Browsing classifies the URL as a social engineering threat, and PhishDestroy lists the domain on its blocklist. VirusTotal reports that five out of ninety‑five scanning engines flagged the domain, indicating malicious behavior despite the relatively low detection ratio.

The page title captured during the brief crawl reads “swiftfxbase247 | CFD Trading — Trading on Stocks, Gold, Oil, Indices,” suggesting a brand‑impersonation campaign aimed at traders interested in contract‑for‑difference products. Technical fingerprints include the use of YouTube embeds, Tailwind CSS, LiteSpeed web server, Alpine.js, Unpkg, jQuery CDN, and the live‑chat widget Chaport, all of which are commonly employed by low‑cost phishing kits to emulate legitimate trading platforms. Nameservers are split between cprapid.com and ecositewebhost.com, a pattern often seen in short‑lived malicious deployments. No SSL certificate is present, exposing any traffic to passive interception.

While the site is presently taken offline, the combination of blocklist placement, Safe Browsing flag, partial VirusTotal detections, and the brand‑impersonation page title justifies an elevated risk rating. Defenders should continue to block the domain at perimeter filters, monitor the IP 192.142.10.129 for any resurgence, and update internal threat intel with the observed indicators of compromise. Additional investigation is recommended to determine whether the associated nameservers are being reused for other fraudulent domains and to verify if any residual payloads were delivered before takedown.