tw-favorites[.]org

This domain, tw-favorites.org, is flagged as a high-severity crypto credential theft operation. Analysis indicates the infrastructure is designed to harvest wallet credentials, recovery phrases, and private keys through deceptive login portals mimicking legitimate cryptocurrency services. No direct brand impersonation or known drainer kit signatures were identified, but the domain exhibits behavioral patterns consistent with credential harvesting campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the domain was registered on May 24, 2026, through Global Domain Group LLC. It is currently hosted on an IP address resolving to a shared cloud provider, though the exact IP remains unconfirmed in this report. VirusTotal detection rates show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains. No Google Safe Browsing (GSB) entries were identified at the time of analysis. The domain remains active and continues to pose a high risk to users. Response actions include blocking at the DNS and network levels by multiple threat intelligence feeds, including wallet security providers and phishing detection systems. Despite these measures, the domain’s infrastructure remains operational, and users are advised to treat any interaction with tw-favorites.org as a direct compromise attempt. Organizations should update blocklists, monitor for connections to this domain, and educate users on recognizing credential theft tactics targeting cryptocurrency wallets.