swiss-borg[.]net

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Binance users. Analysis indicates the site operates as a fraudulent cryptocurrency platform, likely designed to harvest credentials or deploy crypto-draining malware under the guise of "SwissBorg" services. The German-language page title "SwissBorg™: Offizielles KI-Trading in Deutschland | Geprüft & Vertrauenswürdig" directly mimics legitimate trading platforms to exploit trust in established brands. Infrastructure analysis reveals multiple high-risk indicators: the domain resolves to IP address 104.21.83.135, registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026—an anomalous future date suggesting registry manipulation. VirusTotal detection shows 5/95 security vendors flagging the domain, while Gridinsoft assigns a 0/100 trust score. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Current status indicates the site has been taken offline, though historical DNS records may persist. Mitigation requires immediate action from both users and security teams. Users who interacted with swiss-borg.net should revoke all active cryptocurrency wallet sessions, rotate credentials for any linked accounts, and scan devices for malware. Security teams should implement DNS-based blocking for 104.21.83.135 and monitor for related domains using the same registrar or IP range. Given the Binance impersonation, organizations should deploy brand monitoring to detect similar fraudulent domains using variations of "SwissBorg" or "Binance" in German-language contexts. Network defenders should prioritize retroactive log analysis for connections to this IP, particularly from German-language regions.