tw-credit[.]com

This domain, tw-credit.com, operates as a fraudulent crypto card platform designed to deceive users into entering sensitive financial credentials or cryptocurrency wallet details. The site mimics legitimate crypto card services, leveraging branding elements associated with trusted financial providers to lower user defenses. Analysis indicates the domain is engineered to harvest login credentials, private keys, or seed phrases, which could lead to unauthorized asset transfers or account takeovers. The presence of a page title reading 'Trust - Crypto Card' further suggests an attempt to exploit the reputation of established crypto services to lend credibility to the scam. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent financial activity. It was registered through Realtime Register B.V. on May 18, 2026, an unusually future-dated creation that may indicate bulk registration for malicious campaigns. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and resolves to the IP address 172.67.144.85, which is hosted behind Cloudflare’s infrastructure. Additional technologies detected include HSTS, Google Analytics, and Cloudflare Browser Insights, which are often employed to enhance the site’s perceived legitimacy while obscuring its true intent. Users who visited tw-credit.com or interacted with its content should take immediate action to mitigate potential risks. Disconnect any connected wallets or financial accounts and revoke permissions granted to the site via wallet management tools. Scan local devices for malware using updated security tools, as phishing sites may deploy additional payloads. Monitor linked accounts for unauthorized transactions and enable multi-factor authentication where available. Given the domain’s elevated risk level and offline status, users should remain vigilant for similar scams targeting crypto card or financial service users, particularly those impersonating trusted brands.