https://swyftx.system-tools-hub.com/8szww?utm_campaign=JQ_669689246230011_0203_Land374.1_abo_rem_1-2-2&fbid=1213981274182747&utm_content=17swftx150xrp5en_17swftx150xrp3en&cid=1_Pur_701_AuNz_2560_M&bid=BID&subid=2hf5i5.343.11kag
172.67.189.207 · Cloudflare, Inc.
Toronto, Canada
77 days
200 · 19.0s
Valid· WE1, Google Trust Services, US
COMPLETED
Domain Intelligence: system-tools-hub.com
Scanned 3 times since Mar 3, 2026, 06:28 AM UTC
Registered-domain escalation suggested
Suggested nowSubmit system-tools-hub.com as the primary IOC, enriched with evidence from hostile subdomains like swyftx.system-tools-hub.com.
2 hostile subdomains across 3 completed scans were observed under this registered domain. Recent hosts: swyftx.system-tools-hub.com, ethereum.system-tools-hub.com.
swyftx-clone-kit
swyftx-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
finance | technology | ecommerce | cryptocurrency · 4/5/2026
This page at swyftx.system-tools-hub.com presents Swyftx branding and a Swyftx page title, but the domain is a subdomain of system-tools-hub.com and not the legitimate Swyftx domain. The page uses SPA techniques with multiple external scripts and assets mimicking Swyftx’s UI, suggesting an impersonation designed to harvest credentials. The domain name signals and page title strongly indicate Swyftx brand cloning, with a likely credential collection flow embedded in JavaScript bundles.
The page is highly suspicious for credential harvesting. The domain contains the target brand, while the visible UI and page title impersonate Swyftx. Even though the static HTML lacks a form, the SPA-rendered forms are likely loaded via the index-DYk4ZIO9.js bundle, which is consistent with credential phishing flows. The site is served behind a Cloudflare IP and uses PostHog analytics for data collection, plus an embedded chat widget which could be leveraged for social engineering. The SSL certificate is valid but issued to the host domain, not Swyftx, and the domain age is relatively short (77 days), further signaling a risk of impersonation. This is a high-confidence credential-phishing attempt aimed at Swyftx users.
Suspend Domain