tw-order[.]live

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, tw-order.live, operates as a phishing site specifically targeting users of Trust Crypto Card, a cryptocurrency payment service. The site employs deceptive branding and design elements to trick visitors into entering sensitive credentials, such as wallet private keys, recovery phrases, or personal identification details. The intent is to harvest this information for unauthorized access to cryptocurrency accounts or financial fraud. Analysis of the page title, "Trust Crypto Card | Crypto Card," confirms the impersonation of the legitimate service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on April 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3 and is flagged by 14 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent activity. Additionally, the domain appears on three security blocklists, and its Gridinsoft trust score is 0/100, further confirming its malicious nature. Technologies detected on the site include Vue.js for dynamic content rendering, Facebook Pixel for tracking user interactions, and Cloudflare for content delivery and DDoS protection, which may obscure the true origin of the malicious activity. Users who have visited tw-order.live or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts linked to the site and revoke any suspicious permissions granted. Conduct a full scan of the device using updated security tools to detect and remove any malware or unwanted software. Monitor cryptocurrency wallets and financial accounts for unauthorized transactions, and report any suspicious activity to the relevant platform. If credentials were entered, reset passwords and enable multi-factor authentication where possible. Avoid clicking on links from untrusted sources and verify the legitimacy of any cryptocurrency-related communications before taking action.