tw-card[.]app

Analysis of tw-card.app, observed on July 22, 2026, shows a domain created on February 21, 2026 and registered through NameCheap, Inc. The domain resolves to IP address 63.250.43.9, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. Nameserver configuration uses dns1.registrar-servers.com and dns2.registrar-servers.com, while the MX record points to eforward2.registrar-servers.com with priority 10. The site presented a page titled "Trust Wallet Card" and listed Trust Wallet as the targeted brand, indicating a brand‑impersonation crypto scam. Technical footprints reveal a WordPress stack backed by MySQL and PHP, served by Nginx, and employing jQuery and jQuery Migrate libraries; HTTP Strict Transport Security (HSTS) is also enabled.

The HTTPS certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, confirming a valid TLS layer despite malicious intent. A request to the site returned HTTP status 404, suggesting the content was removed or never served. VirusTotal scans show three of ninety‑three security vendors flagged the domain, and it is listed on one external blocklist. The domain has been actively blocked by PhishDestroy.

Current status is offline, and no further content is reachable for deeper forensic review. Defenders should continue to block the domain at network perimeter, monitor for related indicators of compromise tied to the same IP range or Namecheap infrastructure, and update endpoint protection with the observed vendor detections. Additional investigation is warranted to determine whether the infrastructure hosts other malicious sites, given the shared hosting environment.