transfer-tws[.]ink

Analysis of transfer-tws.ink as of July 23, 2026, indicates this domain is part of active phishing infrastructure targeting financial or trading platforms. The domain resolves to IP address 54.39.106.37 and is currently flagged on at least one security blocklist, including PhishDestroy. While VirusTotal scans from 95 vendors show no detections at the time of this report, this absence does not confirm safety, as phishing domains often evade initial detection. The domain remains operational, returning an HTTP 200 status, suggesting the phishing page is live. Infrastructure details reveal the domain uses Let's Encrypt SSL certificate YR2, a common choice for both legitimate and malicious sites due to its free and automated issuance.

Nameservers are hosted on pdns1.registrar-servers.com and pdns2.registrar-servers.com, a configuration frequently observed in phishing campaigns leveraging bulk domain registration services. No specific brand or kit has been confirmed in the available data, and the exact content of the site has not been analyzed. The domain's naming convention, including 'transfer' and 'tws,' suggests it may impersonate trading, brokerage, or banking services, but this remains unconfirmed without further evidence. Defenders should treat transfer-tws.ink as high-risk until additional analysis confirms its intent.

Network-level blocking is recommended based on the current blocklist presence and active resolution. Organizations should monitor for connections to 54.39.106.37 and investigate any user reports of interaction with the domain. Further investigation is required to determine the targeted brand, phishing kit, or payload. No evidence currently links this domain to advanced persistent threats or nation-state actors.