twcards[.]net

PhishDestroy has identified twcards.net as a malicious domain involved in a fake credit card phishing campaign. This site mimics legitimate financial services to trick users into disclosing sensitive payment information. The domain was registered on April 19, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar with a history of enabling fraudulent activity. Currently, it resolves to IP 104.21.77.86 and uses a Let’s Encrypt SSL certificate to appear legitimate. Despite being unflagged on VirusTotal with 5/95 detections, its recent creation and suspicious infrastructure warrant immediate caution.

This domain poses a direct threat to users seeking financial tools or services, as it is designed to harvest credit card details and personal data under false pretenses. The combination of a newly registered domain, low detection rates, and use of a reputable SSL provider highlights the evolving tactics of threat actors. At the time of analysis, there are no known blocklist entries for this domain, increasing the risk of exposure for unsuspecting visitors.

If you have visited twcards.net, assume your data may have been compromised. Cease all financial transactions linked to cards entered on the site, monitor your accounts for unauthorized activity, and consider freezing affected cards. Use a reputable password manager to check for exposed credentials and enable two-factor authentication on all financial accounts. Report suspicious activity to your bank and submit a report to PhishDestroy to aid in tracking this threat vector.