flareswap[.]xyz

PhishDestroy identifies flareswap.xyz as an active domain under investigation for a generic phishing threat. While the specific impersonated brand is unknown, the risk level remains elevated due to its potential use in deceptive practices aimed at harvesting credentials or deploying crypto drainers.

The domain flareswap.xyz was created recently on October 17, 2025, and resolves to the IP address 13.248.169.48. It uses an SSL certificate issued by GoDaddy.com, Inc., and was registered through GMO Internet, Inc. Despite a clean VirusTotal score showing 0 detections out of 95 engines, this domain remains suspicious due to its recent creation and lack of established trust indicators. There are currently no blocklist or trust score entries available, which further emphasizes the need for caution.

To mitigate risk associated with flareswap.xyz, users should avoid clicking any links or submitting credentials on the site. Organizations should consider adding the IP 13.248.169.48 and the domain itself to internal monitoring or blocking tools. Users are advised to verify any suspicious interactions involving this domain on PhishDestroy and maintain updated endpoint security solutions to detect potential phishing payloads or credential theft attempts.