tws-billing[.]org

This domain is flagged as a high-risk credential theft operation targeting users through deceptive login portals. Analysis indicates the site is designed to harvest usernames, passwords, and other sensitive authentication details under the guise of a legitimate billing service, a common tactic in account takeover schemes. Infrastructure analysis reveals the domain tws-billing.org was registered on June 11, 2026, through Global Domain Group LLC. It currently resolves to IP address 104.21.32.60, a Cloudflare-associated endpoint that provides SSL encryption via a Google Trust Services certificate. Despite the presence of a valid SSL certificate, only 2 out of 95 security vendors on VirusTotal have flagged this domain as malicious, suggesting either recent deployment or evasion techniques. The domain remains active with no widespread blocklisting, though its creation date in the future (2026) is anomalous and indicative of potential registrar manipulation or typosquatting. Mitigation against credential theft from this domain requires immediate action. Users who may have interacted with tws-billing.org should invalidate any entered credentials, particularly for financial or email accounts, and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (104.21.32.60) at the perimeter, while monitoring for outbound connections to this endpoint. Given the low detection rate, manual inspection of logs for HTTP requests to tws-billing.org is recommended, as automated tools may not yet recognize this threat. Organizations should also review registrar records for similarly named domains registered through Global Domain Group LLC, as this may indicate a broader campaign.