tws-checkout[.]org

This domain, tws-checkout.org, is actively engaged in credential harvesting phishing operations targeting users through fraudulent checkout or authentication pages. Analysis indicates the site is designed to mimic legitimate transaction portals, tricking victims into entering sensitive login credentials, payment details, or personal information. The infrastructure is optimized for high-volume phishing campaigns, with a focus on financial or e-commerce impersonation. Infrastructure analysis reveals the domain was registered on June 21, 2026, through Global Domain Group LLC, a registrar frequently associated with phishing and abuse. It resolves to the IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. As of the latest assessment, only 2 out of 95 security vendors on VirusTotal have flagged this domain, suggesting it remains under-detected and actively evades common blocklists. No additional blocklist entries have been confirmed, further indicating its operational status. Users who have visited tws-checkout.org or entered credentials on the site should immediately revoke any submitted information, particularly passwords, credit card numbers, or other sensitive data. It is recommended to reset credentials for any accounts accessed after visiting the domain, enable multi-factor authentication where possible, and monitor financial statements for unauthorized transactions. Network administrators should block the domain and its resolving IP address (188.114.96.3) at the perimeter to prevent further exposure. If the site was accessed via a corporate or institutional network, incident response protocols should be initiated to assess potential data compromise.