jtwen[.]com

jtwen.com is currently active and serves a credential‑phishing page whose HTML title is “Google”. The domain was registered on 1 August 2017 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (IP 172.67.189.148, Canada). It uses the nameservers piotr.ns.cloudflare.com and zoe.ns.cloudflare.com, returns HTTP 200, and presents a TLS certificate issued by Google Trust Services / WE1, which is unusual for a phishing infrastructure. Infrastructure analysis shows a Gridinsoft trust score of 0 / 100 and the domain appears on three public blocklists. It is already blocked by PhishDestroy, MetaMask and SEAL. VirusTotal scans report 7 of 91 security vendors flagging the domain as malicious. The site is classified as credential phishing and explicitly impersonates Google. While the page content has not been inspected, the combination of a Google‑related title, a Google‑issued certificate, and the detection history indicates a high‑confidence threat. Defenders should add jtwen.com to URL filtering rules, ensure DNS‑level blocking, monitor outbound connections to the associated IP, and educate users that any unsolicited request for Google credentials from this domain is malicious. Ongoing threat‑intel should watch for possible infrastructure changes, such as new IPs or certificates, and update detection signatures accordingly.