kowa-bosai[.]jp

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Swiss payment application TWINT. Analysis indicates the infrastructure is actively impersonating TWINT’s official branding, as evidenced by the page title "TWINT : l’app de paiement de Suisse - payer, envoyer de l'argent et bien plus encore," which directly mirrors the legitimate service’s messaging. The threat type is narrowly defined as brand impersonation, with no evidence of crypto drainer or credential theft payloads at this time, though such tactics may evolve. Infrastructure analysis reveals the following technical indicators: the domain kowa-bosai.jp resolves to IP address 157.7.107.46, hosted on AS7506 (GMO Internet, Inc.) in Japan. The domain was registered on November 11, 2010, though recent activity suggests it may have been compromised or repurposed for malicious use. The SSL certificate is issued by Let’s Encrypt (YR2), a common choice for both legitimate and malicious sites due to its accessibility. The domain appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious, indicating moderate but growing detection coverage. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (157.7.107.46) at the network perimeter. Organizations should alert users to verify payment application URLs directly through official sources, avoiding links in unsolicited messages. Security teams are advised to monitor for additional domains impersonating TWINT or other financial services, particularly those using Let’s Encrypt certificates or hosted on shared infrastructure. End users should report any suspicious login pages to their financial institution and refrain from entering credentials on untrusted sites.