debit-tws[.]com

Analysis indicates that debit‑tws.com was registered on 2026‑06‑04 through a Dutch registrar and is currently active. The domain resolves to IP 188.114.96.3, which belongs to a large content‑delivery network operating from Canada. DNS is handled by two nameservers that are associated with the same CDN provider. HTTPS is enforced via HSTS and the TLS certificate is signed by a well‑known certificate authority. The page returns HTTP 200 and the title observed is “Loading…”. Traffic to the site includes analytics and browser‑insight scripts, and the server supports HTTP/3. The domain appears on three public blocklists and has been flagged by multiple sink‑hole feeds, indicating consensus that it is used for generic phishing. VirusTotal scans show three detections out of ninety‑one scanners, and a separate trust‑score service assigns a score of zero, reinforcing the malicious assessment. What remains unclear is the exact phishing payload or lure presented to victims, as the page content has not been captured. Defenders should block DNS resolution for the domain, add the IP address to network‑level deny lists, and monitor for outbound connections to the CDN provider’s edge nodes. Incident response teams should also inspect any logs for attempts to contact this domain and consider quarantining affected endpoints. Ongoing monitoring of the listed blocklists is recommended to capture any changes in the domain’s status.