tw-crypt[.]org

Analysis indicates that the domain tw-crypt.org was registered on July 17 2026 through Fewmoretaps OU d/b/a Trustname.com and is currently active. DNS resolution points to the IP address 104.21.71.241, which is hosted behind Cloudflare as evidenced by the authoritative nameservers dalary.ns.cloudflare.com and ignacio.ns.cloudflare.com. The domain was submitted to VirusTotal where 95 antivirus and URL scanners evaluated the host; none reported a detection at the time of analysis. While the absence of detections does not imply legitimacy, it demonstrates that automated signatures have not yet flagged the site.

The domain appears on a single public blocklist, PhishDestroy, confirming that at least one security community has identified it as malicious. No additional blocklist entries, Safe Browsing alerts, or Open Threat Exchange (OTX) reports are currently associated with the domain. The rapid creation date, use of a reputable registrar, and immediate deployment of Cloudflare services are consistent with a short‑lived phishing infrastructure designed to evade reputation buildup. The lack of publicly available SSL certificate details, HTTP response codes, or page title information limits the ability to confirm the exact phishing payload or targeted brand.

Consequently, the primary observable indicators are the domain’s registration metadata, DNS configuration, and its presence on PhishDestroy. Defenders should block network connections to 104.21.71.241 when associated with the FQDN tw-crypt.org, add the domain to internal URL filtering lists, and monitor for any future detections in sandbox or endpoint telemetry. Continuous re‑scanning on VirusTotal and periodic checks against additional blocklists are recommended to capture any subsequent classification changes. Given the active status and the limited intelligence, the domain should be treated as a potential phishing vector until further evidence either confirms benign use or reveals a concrete malicious campaign.