swarmnode-migrate[.]xyz

This domain, swarmnode-migrate.xyz, has been identified as a credential harvesting phishing infrastructure designed to deceive users into disclosing authentication credentials through fraudulent login interfaces. Analysis indicates the site employs social engineering tactics, presenting itself as a legitimate service migration portal while capturing sensitive user input. The page title 'Un instant…' suggests an attempt to mimic loading screens commonly associated with legitimate authentication flows, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domain registrations. Security vendors have flagged the domain, with 6 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on two security blocklists, further corroborating its fraudulent nature. The site resolves to IP address 172.67.194.196, a Cloudflare-protected endpoint, which is commonly exploited to obfuscate the true origin of phishing infrastructure. Users who have visited swarmnode-migrate.xyz should immediately revoke any credentials entered on the site, particularly if they were used across multiple services. It is recommended to perform a full security audit of associated accounts, including enabling multi-factor authentication where available. Network administrators should block the domain and its resolving IP at the perimeter to prevent further access. Given the elevated risk level, affected users should monitor for unauthorized access attempts and report any suspicious activity to their security teams.