tws-favorites[.]com

This domain, tws-favorites.com, is under investigation for facilitating cryptocurrency wallet credential harvesting. Analysis indicates the site mimics legitimate wallet interfaces to deceive users into submitting private keys or recovery phrases. The infrastructure employs obfuscation techniques, such as a generic 'Loading…' page title, to delay detection while awaiting victim interaction. The domain was registered on June 01, 2026, a date inconsistent with typical legitimate service timelines, suggesting potential domain spoofing or future-dated registration abuse. Technical indicators reveal the domain resolves to the IP address 188.114.96.3 and was registered through Hosting Concepts B.V. d/b/a Registrar.eu. Despite its malicious intent, the domain currently exhibits 0 detections out of 95 engines on VirusTotal, highlighting limitations in automated detection for emerging threats. However, it appears on 3 security blocklists and is referenced in 2 AlienVault OTX threat intelligence pulses, corroborating its association with phishing activity. The site employs HSTS, Cloudflare, and Google Analytics, which are often leveraged to enhance legitimacy or evade scrutiny. Users who accessed tws-favorites.com should immediately revoke any permissions granted to the site, particularly within cryptocurrency wallet applications. All credentials or recovery phrases entered on the domain must be considered compromised and should be transferred to a new wallet using a secure, offline environment. Monitoring for unauthorized transactions is critical, as harvested credentials may be exploited within hours. Network administrators are advised to block the IP address 188.114.96.3 and the domain at the perimeter to prevent further exposure.