tw-account385372[.]com

PhishDestroy identifies tw-account385372.com as a credential phishing domain, currently offline, which was impersonating a brand to trick users into revealing sensitive information. This domain was flagged by 3 of 95 VirusTotal vendors, registered through HOSTINGER operations, UAB, and resolves to IP 2a02:4780:3f:2073:0:1dee:ceb:3, it was created on February 21, 2026, and appears on 1 security blocklist with an SSL certificate issued by WR1.

The fact that it was taken offline indicates a response to the threat it posed, but users should remain cautious as similar domains may still be active, and with a risk level of elevated, PhishDestroy advises users to be vigilant and verify the authenticity of websites before entering credentials, as this domain's history suggests it was designed to deceive.

Given the elevated risk level and the specific threat type of credential phishing, users should exercise extreme caution when encountering similar domains, and the fact that 3 of 95 VirusTotal vendors flagged it underscores the importance of relying on multiple sources for threat assessment, and as this domain is currently offline, users can check the full report for updates and safety guidance to protect themselves from such threats.