twtte[.]cfd

twtte.cfd is a newly observed domain that was registered on 11 October 2025 through Porkbun LLC. The zone is delegated to Cloudflare name servers (howard.ns.cloudflare.com, sharon.ns.cloudflare.com) and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the site, indicating that HTTPS is not configured. The page title returned by the HTTP response is “Get Your Rewards!”, and the domain is explicitly listed as impersonating the TrustWallet brand. The site has been taken offline and is currently blocked by the PhishDestroy sinkhole, but remnants of the infrastructure remain observable through DNS and IP data.

Threat‑intelligence aggregators have flagged the domain: three of ninety‑five VirusTotal scanners reported it as malicious, and it appears on one external blocklist. The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. No additional evidence such as malware samples, credential‑stealing forms, or redirect chains has been published, so the exact payload or user‑interaction flow remains unknown. However, the combination of brand impersonation, a reward‑oriented page title, and the lack of TLS suggests a classic lure aimed at obtaining TrustWallet credentials or private keys.

Defenders should add 188.114.97.3 to network‑level deny lists, monitor DNS queries for twtte.cfd and its Cloudflare name servers, and ensure that endpoint protection solutions are updated to flag the domain based on the existing VirusTotal and blocklist entries. Organizations that use TrustWallet should remind users that legitimate communications never use domains outside the official trustwallet.com ecosystem and that any request to “Get Your Rewards!” is likely fraudulent. Continuous re‑evaluation is advised in case the domain is re‑hosted or the threat actor reactivates the site.