tw-card[.]sbs

This domain, tw-card.sbs, is actively impersonating Google to deceive users into disclosing sensitive information or installing malicious software. Brand impersonation threats like this often use familiar logos, login prompts, or reward offers to trick victims into entering credentials or downloading files. The site may also serve as a gateway for crypto drainers or other forms of financial fraud, leveraging Google's reputation to bypass user skepticism. Analysis indicates this infrastructure is designed for malicious purposes. The domain was registered on June 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), which is commonly used to obscure the true origin of phishing sites. Security vendors on VirusTotal have flagged tw-card.sbs, with 3 out of 95 engines detecting it as malicious. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy, though this is a tactic often exploited by threat actors to appear trustworthy. If you or someone else has visited tw-card.sbs, immediate action is required to mitigate risk. Do not enter any credentials or personal information on the site. If login details were submitted, change passwords for all associated accounts, especially Google services, and enable multi-factor authentication where possible. Scan the device used to access the site with updated security software to detect potential malware. Monitor financial accounts and credit reports for unauthorized activity, as stolen credentials may be used for follow-on attacks. Report the domain to your organization's security team or relevant authorities to aid in takedown efforts.