tw-provider[.]one

PhishDestroy identifies tw-provider.one as an active generic phishing domain posing as a telecommunications provider to harvest user credentials. The domain remains under investigation by security teams while actively distributing lures. Brand impersonation has not yet been formally confirmed, but the page style mimics legitimate provider login portals to deceive visitors.

This domain was flagged by 0 of 95 VirusTotal vendors as of time of writing, indicating it has not yet been widely blacklisted despite appearing on threat radar. The domain was registered on April 19, 2026 through Global Domain Group LLC, resolving to IP address 104.21.55.82 and secured with a Let’s Encrypt SSL certificate. Analysis shows no current listings on major DNS or IP blocklists, resulting in neutral trust scores across threat intelligence platforms. The use of a newly registered domain with low detection rates suggests an emerging campaign leveraging time-to-live tactics.

Tw-provider.one remains active and should be treated as a high-risk domain until further analysis confirms its takedown. Users are advised to immediately cease any interaction with the domain, avoid submitting credentials or personal data, and report suspicious activity to their IT security teams. Network administrators should block IP 104.21.55.82 and the domain at the firewall level. Security teams should monitor DNS logs for resolution attempts and scan internal systems for signs of compromise following exposure. Regular threat intelligence updates are recommended due to the domain’s evolving status.