tw-payment[.]co

tw-payment.co was registered through Dynadot Inc on 21 May 2026. The domain currently resolves to the IP address 188.114.96.3 and uses Cloudflare’s DNS infrastructure (hal.ns.cloudflare.com, nelly.ns.cloudflare.com). Public threat intelligence sources have placed the domain on three security blocklists and it is actively blocked by the PhishDestroy, MetaMask, and SEAL filters.

A VirusTotal scan submitted the domain to 91 antivirus and URL scanning engines; none of the engines returned a positive classification at the time of analysis. No additional metadata such as SSL certificate details, HTTP response codes, or page title information has been disclosed, limiting the ability to confirm the exact phishing lure or content hosted on the site. The lack of visible page-level indicators means that the specific brand or credential‑stealing technique employed by the site cannot be confirmed beyond the generic phishing label supplied in the source data.

Analysts should treat the domain as a potential credential‑harvesting infrastructure and enforce network‑level deny rules for the resolved IP and associated hostnames. Continuous monitoring of DNS queries and outbound connections to the IP address is recommended, as is periodic re‑scanning on VirusTotal and other sandbox services to capture any future payload changes. Organizations that rely on cloud‑based or browser‑based security stacks should verify that their existing blocklists include the domain and consider adding it to internal URL filtering policies.