twpay[.]cards

PhishDestroy identifies twpay.cards as an active PayPal-themed phishing domain designed to harvest user credentials and financial data through deceptive payment portals.

This domain, registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on April 24, 2026, currently resolves to IP 188.114.96.3 and operates under a Let’s Encrypt SSL certificate. Despite zero detections on VirusTotal (4/95 scans) as of initial analysis, the domain remains unlisted across major threat intelligence feeds, indicating a newly emerged or stealthily operated infrastructure. The combination of a recent creation date, low detection rate, and active hosting suggests an evolving threat that may evade conventional defenses in the short term.

Users who visited twpay.cards should immediately cease any interaction with the site and avoid entering login or payment details. Scan all connected devices for credential-stealing malware, and rotate passwords for PayPal and linked financial accounts. Report suspicious activity to PayPal and your bank, and update browser security settings to block the domain. Monitor accounts closely for unauthorized transactions and enable two-factor authentication where available. For further protection, isolate any device exposed to this domain and consider a full system scan using reputable endpoint protection tools.