swpx[.]cc

Analysis of the domain swpx.cc, observed on July 25 2026, indicates a phishing‑related threat that has been taken offline. The domain was registered on 26 February 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the expired‑ns1.niceisp.com and expired‑ns2.niceisp.com nameservers. Public scanning services have placed the domain on three independent blocklists, and it is actively blocked by PhishDestroy, MetaMask, and the SEAL filtering system. VirusTotal records show that three out of ninety‑three scanners flagged the site, confirming the presence of malicious content at the time of analysis.

The site resolved to the IP address 172.67.131.144, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate labeled “WE1” was observed, indicating that transport‑layer encryption was configured when the site was live. The only visible page attribute is the title “SwapX”, but no further page content has been captured because the host is currently offline. The combination of recent registration, use of generic expired nameservers, Cloudflare front‑end, and multiple security vendor detections aligns with typical phishing infrastructure.

Uncertainty remains regarding the specific lure or credential‑harvesting mechanism employed, as no payload or landing‑page screenshots are available. Defenders should continue to block the domain at DNS and proxy layers, add it to internal threat‑intel feeds, and monitor the associated IP range for any resurgence. Additional scrutiny of future DNS resolutions or TLS certificates issued for the same registrar may reveal re‑use of the infrastructure.