twtts[.]cfd

The domain twtts.cfd was first observed on July 12, 2026 and is presently classified as a high‑risk generic phishing site. The site returns an HTTP 301 redirect and presents the page title “Get Your Rewards!”. Its risk rating is high and the status remains active despite being listed on a security blocklist. Infrastructure analysis shows the domain was registered through Porkbun LLC on 11 October 2025. DNS resolution points to the Cloudflare network (AS13335) with the IP address 172.66.44.233 located in the United States. The authoritative nameservers are howard.ns.cloudflare.com and sharon.ns.cloudflare.com. The site enforces HSTS and serves traffic over HTTP/3, and its TLS certificate is issued by Google Trust Services under the WE1 profile. Threat intelligence indicates that three of ninety‑five security vendors on VirusTotal have flagged the domain, and it is currently blocked by the PhishDestroy list. The domain appears on one additional blocklist, reinforcing the suspicion of phishing activity. No further page content has been publicly disclosed, so the exact tactics, techniques, and procedures employed by the operators remain unknown. Defenders should immediately add twtts.cfd to outbound filtering rules and DNS blocklists, monitor for any outbound connections to the associated IP address, and consider sinkholing the domain to disrupt command‑and‑control traffic. Continuous re‑evaluation is recommended, as additional indicators may emerge if the site begins to serve malicious payloads or credential‑harvesting forms.