tws-secure[.]org

The domain tws-secure.org is currently active and engaged in credential phishing targeting cryptocurrency wallet users. Analysis indicates this infrastructure is designed to harvest login credentials through fake security verification pages, specifically impersonating wallet security interfaces. The page title 'Crypto Cards' suggests an attempt to mimic legitimate crypto card services or wallet authentication portals. Infrastructure analysis reveals the domain was registered on June 21, 2026, through Global Domain Group LLC. It resolves to the IP address 172.67.171.23 and has been flagged by 4 of 95 security vendors on VirusTotal. The domain appears on three security blocklists and has been documented in one AlienVault OTX threat intelligence pulse. These indicators collectively demonstrate a pattern of malicious activity associated with credential theft operations. The domain remains active as of this report. Organizations and individuals are advised to block both the domain and its resolving IP at the network perimeter. End users should avoid interacting with any authentication prompts originating from tws-secure.org and report any suspected phishing attempts to their security teams. Security teams are recommended to monitor for connections to 172.67.171.23 and investigate any associated credential submissions or wallet transaction anomalies.