twtbox[.]cfd

twtbox.cfd was registered on October 11, 2025 through Porkbun LLC. The domain resolves to 172.66.44.149, an address owned by AS13335 Cloudflare, Inc. and located in the United States. DNS records list guss.ns.cloudflare.com and vera.ns.cloudflare.com as authoritative nameservers, indicating the use of Cloudflare’s DNS service. The site presented the page title “Get Your Rewards!” and was classified as a brand‑impersonation campaign targeting TrustWallet, consistent with the supplied brand target. No TLS certificate was observed; the service responded without HTTPS, which is atypical for a payment‑related phishing operation but aligns with the low Gridinsoft trust score of 0/100.

VirusTotal scans recorded five detections out of ninety‑five submitted engines, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and current status reports confirm that the site is no longer reachable. The combination of a recent registration date, Cloudflare‑hosted infrastructure, and the absence of encryption suggests a short‑lived campaign designed to harvest credentials or lure users with a reward promise.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanism, as no page content beyond the title has been publicly disclosed. Defensive operators should continue to enforce deny‑list rules for twtbox.cfd and its resolved IP address, monitor Cloudflare‑associated ranges for similar newly registered domains, and incorporate the observed detection signatures into intrusion‑detection and web‑filtering solutions. Ongoing intelligence collection is recommended to capture any re‑deployment attempts that may reuse the same branding or infrastructure.