tw-coin[.]com

This domain is flagged as a high-risk crypto drainer infrastructure, designed to impersonate legitimate cryptocurrency card services. Analysis indicates the site employs wallet-draining scripts to siphon funds from victims under the guise of a "Crypto Cards" platform, a tactic increasingly observed in targeted cryptocurrency theft campaigns. Infrastructure analysis reveals the domain tw-coin.com is registered through Fewmoretaps OU d/b/a Trustname.com, with a creation date of July 01, 2026. It currently resolves to the IP address 188.114.97.3 and has been detected by 3 out of 95 security vendors on VirusTotal. Despite its recent registration, the domain remains active and unblocked by most reputation systems, suggesting it may evade automated detection through rapid rotation or obfuscation techniques. The page title "Crypto Cards" aligns with known impersonation patterns targeting users of decentralized finance and crypto payment services. Mitigation requires immediate action from cryptocurrency users and security teams. Users should verify domain authenticity by cross-referencing official sources before connecting wallets or entering credentials. Wallet providers and exchanges are advised to monitor for connections originating from 188.114.97.3 and domains registered under the same registrar, particularly those mimicking crypto card services. Network-level blocking of the IP and domain is recommended, alongside deployment of transaction simulation tools to detect and prevent unauthorized fund transfers. Security teams should prioritize hunting for related infrastructure using the registrar and IP as pivot points, as this domain may be part of a larger, evolving campaign.