tw[.]gtws[.]ink

Analysis of tw.gtws.ink, observed on July 24, 2026, shows several indicators consistent with a malicious phishing operation. The domain resolves to the IP address 154.209.5.13, which is hosted in Hong Kong under autonomous system AS142403 operated by YISU CLOUD LTD. Registration records reveal that the domain was created on November 18, 2024 and was procured through Dynadot LLC, using the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. No TLS certificate was presented for the site, indicating that communication occurred over unencrypted HTTP, a characteristic often exploited by phishing actors to simplify content delivery and evade inspection.

The page title returned by the server is "Home - 隨E貸金融," suggesting a financial‑oriented lure, though the exact content of the landing page has not been examined. Reputation metrics further corroborate malicious intent: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and VirusTotal reports that 2 of 95 scanned security vendors flagged the host, providing independent confirmation of suspicious behavior. The domain is currently listed as offline, which may be the result of takedown actions or temporary hosting changes; however, the historical evidence remains relevant for threat‑intel correlation.

Uncertainty remains regarding the specific phishing campaign mechanics, such as credential collection forms or targeted victim demographics, because no detailed page capture is available. Defenders should continue to deny traffic to both the domain and its associated IP address, monitor for re‑registration or similar domains using the same registrar and name‑server pattern, and consider adding the IP to network‑level blocklists. Ongoing observation of the ASN and regional hosting trends is advisable, as compromise of YISU CLOUD infrastructure could affect additional domains.