favorites-tw[.]org

This domain, favorites-tw.org, is identified as a crypto drainer phishing site designed to harvest wallet credentials through fraudulent Trust Crypto Card pages. Analysis of the page title, 'Trust - Crypto Card,' confirms impersonation of a legitimate cryptocurrency service to deceive users into entering sensitive information. No specific drainer kit signatures were detected in initial scans, but the domain exhibits characteristics consistent with credential theft infrastructure targeting digital asset holders. Infrastructure analysis reveals the following technical indicators: VirusTotal records 0 detections out of 95 engines, indicating no prior flagging at the time of assessment. The domain was registered on May 23, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.191.193, hosted behind Cloudflare, which obscures origin server details. The domain appears on 3 security blocklists, and while Google Safe Browsing (GSB) status is not explicitly listed, it is actively blocked by wallet security extensions. Detected technologies include HSTS, Google Analytics, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to mimic legitimate security and performance features. Current status indicates the domain has been taken offline, likely due to enforcement actions by security providers or hosting interventions. Despite its offline state, residual risk persists for users who may have interacted with the domain prior to takedown. Historical DNS records and cached content may still pose a threat if accessed through local resolvers or archived pages. Organizations are advised to monitor for connections to 172.67.191.193 and the domain in proxy logs, and to update blocklists to include this indicator. Users should verify wallet security and revoke any suspicious authorizations linked to the Trust Crypto Card branding.