transworldtrust[.]com

The domain transworldtrust.com is currently active and has been classified as a generic phishing site with a high risk rating. The page title returned by the server reads “Transworldtrust - Dedicated to innovating, simplifying, and humanizing digital banking,” indicating an attempt to appear as a legitimate financial service. The site responds with HTTP 200 and supports HTTP/3, suggesting a modern web stack.

Infrastructure analysis shows the domain was registered on February 21, 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to IP address 173.0.59.2, which is assigned to AS27323 Wowrack.com in the United States. DNS resolution is handled by ns1.korrectserver.com and ns2.korrectserver.com. The site presents a Let’s Encrypt certificate (R12) and employs front‑end libraries including Bootstrap, LiteSpeed, GSAP, Smartsupp, OWL Carousel, and jQuery. These components are commonly observed in compromised or malicious sites that reuse publicly available frameworks.

Threat indicators reinforce the phishing assessment. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records 2 out of 95 security vendors flagging the domain as malicious. Additionally, AlienVault OTX references the domain in one threat‑intelligence pulse. The combination of low trust scores, blocklist presence, and vendor detections provides concrete evidence of malicious intent.

Defenders should treat transworldtrust.com as a high‑confidence phishing indicator. Immediate actions include adding the domain and its associated IP address to inbound and outbound deny lists, monitoring DNS queries for the authoritative nameservers, and employing URL filtering to prevent user access. Continuous threat‑intel feeds should be consulted for any emerging indicators, and security teams should consider sinkholing the domain to disrupt its infrastructure while gathering further forensic data.