swift-oxygen-wide[.]on-fleek[.]app

This domain, swift-oxygen-wide.on-fleek.app, is flagged as an active phishing site targeting users through a fraudulent giveaway scheme. Analysis of the page title, "Special Member Giveaway," indicates an attempt to lure victims with false promises of rewards or exclusive offers. The domain is currently resolving to IP address 172.67.73.189, hosted on infrastructure belonging to Cloudflare, Inc. (AS13335), a common tactic to obscure the true origin of malicious activity. The site employs a Let's Encrypt SSL certificate, which while providing encryption, does not validate the legitimacy of the content being served. Infrastructure analysis reveals the domain is registered through 1API GmbH and utilizes Cloudflare nameservers, specifically rihana.ns.cloudflare.com and scott.ns.cloudflare.com. The HTTP status code 301 suggests a redirect mechanism may be in place, potentially rerouting victims to additional malicious endpoints. As of July 12, 2026, the domain appears on five security blocklists and is flagged by 12 out of 95 security vendors in VirusTotal, confirming its classification as high-risk. The exact nature of the phishing kit or the specific brand being impersonated remains unconfirmed, as no additional technical indicators beyond the page title are currently available. Defenders should treat this domain as actively malicious and prioritize blocking it at the network level. The use of Cloudflare infrastructure complicates traditional IP-based blocking, so DNS-level or domain-based restrictions are recommended. Organizations should monitor for any internal traffic attempting to connect to this domain, as it may indicate compromised endpoints or users who have engaged with the phishing lure. While the giveaway theme is evident from the page title, the absence of further details means defenders should remain vigilant for secondary payloads or follow-on attacks, such as credential harvesting or malware distribution, which may occur post-redirect.