tw-billing[.]com

This domain, tw-billing.com, is flagged as a high-risk generic phishing site targeting cryptocurrency users. Analysis indicates it impersonates a crypto card service, as evidenced by the page title 'Trust - Crypto Card,' suggesting an attempt to deceive victims into entering payment or wallet credentials. No specific drainer kit signatures were identified, but the domain aligns with known phishing tactics used to harvest sensitive financial data from cryptocurrency holders. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 23, 2026, through Realtime Register B.V., an unusual future date that may indicate registry manipulation or data obfuscation. It resolves to the IP address 188.114.97.3 and employs technologies including HSTS, Google Analytics, and Cloudflare, alongside HTTP/3 for enhanced performance and evasion. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Additionally, the domain is actively blocked by multiple security layers, including browser-based and cryptocurrency wallet protections. The domain is currently offline, reducing immediate exposure risk. However, historical data and blocklist persistence indicate prior malicious activity. Response actions should include continued monitoring for domain reactivation or rebranding under similar naming conventions. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. The remaining risk stems from potential secondary infrastructure reuse, such as the resolved IP or registrar, which may host future phishing campaigns. Network-level blocking of the IP and domain is recommended for proactive defense.