The domain tw-dash.org is currently active and was registered on July 20, 2026 by Fewmoretaps OU doing business as Trustname.com. Its authoritative name servers are eva.ns.cloudflare.com and jonah.ns.cloudflare.com, and DNS resolution points to the address 104.21.66.170, which is hosted on Cloudflare’s network. VirusTotal analysis shows that three of ninety‑one scanned security vendors flagged the domain, indicating a non‑trivial detection rate despite the limited sample.
The domain appears on three public security blocklists and is specifically listed as blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple anti‑phishing and cryptocurrency‑wallet protection services have observed malicious activity associated with this host. Intelligence categorises the threat as generic phishing, and the risk level has been assessed as high. At present, no public information about the website’s page title, SSL certificate details, HTTP response codes, or content has been disclosed, leaving the exact phishing payload and target audience uncertain.
Defenders should add tw-dash.org to network‑level blocklists, enforce DNS filtering that references the listed blocklists, and monitor outbound connections to the IP 104.21.66.170 for anomalous traffic. Continuous re‑inspection of the domain on VirusTotal and similar sandbox services is advised to capture any evolution in malicious behavior, and any detection by endpoint or email security products should be escalated for further forensic analysis.