twt-safe[.]cfd

PhishDestroy identified the domain twt-safe.cfd as a generic phishing threat posing as TrixWallet, a TRON blockchain wallet platform. The domain, which was designed to mimic the legitimate wallet service, was registered with the intent to deceive users into revealing sensitive credentials or private keys. No specific drainer kit was identified, but the phishing page title explicitly claimed to be TrixWallet, indicating a targeted impersonation of that brand.

Technical analysis reveals that only 1 out of 95 security vendors on VirusTotal flagged this domain, and it appears on a single security blocklist. The domain was registered through Global Domain Group LLC on May 22, 2026, and resolves to IP address 104.248.137.19. It was secured with a Let's Encrypt SSL certificate (issuer YE1), which is commonly abused by phishing sites to appear legitimate. Google Safe Browsing status was not explicitly provided but the low blocklist count suggests limited prior detection.

As of the latest assessment, the domain is offline, indicating that it was likely taken down by the hosting provider or registrar in response to security reports. However, the remaining risk is moderate, as the underlying infrastructure may be reused for similar attacks. Users who may have interacted with the site should immediately change any passwords used and enable two-factor authentication on their TRON wallet accounts. PhishDestroy recommends monitoring for any unauthorized transactions and reporting the domain to relevant authorities to prevent future abuse.