twcheck[.]finance

This domain, twcheck.finance, is an active high-risk phishing infrastructure registered on May 27, 2026, through Global Domain Group LLC. As of July 12, 2026, it resolves to IP 91.219.239.177 (HU, ServerAstra Kft.) and returns an HTTP 200 status with the page title 'AML Service.' The domain is classified as an investment scam and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Infrastructure analysis reveals nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com, a pattern consistent with other fraudulent domains managed by the same registrar. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Two of 91 security vendors on VirusTotal flag this domain, though the specific detection context is not detailed in available intelligence. The exact content and targeting mechanism of the site remain unconfirmed, as no brand impersonation or phishing kit details are provided. Defenders should treat this domain as active threat infrastructure, particularly in financial or compliance-related contexts where AML-themed lures are effective. Blocking at the DNS or network level is recommended, along with monitoring for connections to the associated IP (91.219.239.177) or registrar-linked nameservers. Further analysis of the site’s behavior, such as form submissions or redirect chains, is advised if internal logs indicate user interaction.