cards-tw[.]icu

Analysis of cards-tw.icu indicates that the domain was registered on June 03, 2026 through NameCheap, Inc. and is currently active, resolving to the IPv4 address 198.54.116.238. The authoritative name servers for the domain are dns1.namecheaphosting.com and dns2.namecheaphosting.com. VirusTotal scans show that three of ninety‑five security vendors have flagged the domain, suggesting malicious intent, though the majority of scanners have not yet generated a detection. The domain is listed on three public security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing the assessment of a phishing threat.

No public SSL certificate or HTTP response data were available at the time of analysis, so the presence of HTTPS or the specific server response code remains uncertain. Likewise, page‑level metadata such as title, brand targeting, or phishing kit identifiers have not been disclosed, limiting the ability to attribute the campaign to a specific lure or toolkit. Defenders should prioritize blocking traffic to 198.54.116.238 and add cards-tw.icu to local deny lists.

Network monitoring should include DNS query logging for the domain's name servers to detect any internal resolution attempts. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection status, and threat‑intel feeds should be updated to reflect the domain's inclusion on existing blocklists. Organizations using the PhishDestroy, MetaMask, or SEAL services should verify that the current blocks remain in place and consider supplemental filtering rules to mitigate potential credential harvesting attempts originating from this infrastructure.