# PhishDestroy domain threat record: terrawallet.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/terrawallet.org/ Machine-readable companion: https://phishdestroy.io/domain/terrawallet.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:53:29 UTC - Last availability or vendor check: 2026-10-23 10:18:10 UTC - Stored record updated: 2026-10-23 10:51:50 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 91.239.77.41 - Registrar in stored WHOIS data: NameSilo, LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, terrawallet.org): 2026-09-17 20:41:54 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16675-8285-7238-b769-25774dca648e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/terrawallet.org - Certificate Transparency search: https://crt.sh/?q=%25.terrawallet.org - Web Archive lookup: https://web.archive.org/web/*/https://terrawallet.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classified terrawallet.org as a seed‑phrase theft page. The recorded page title reads “Terra Station Wallet — Official Desktop Crypto Wallet”, which suggests impersonation of the legitimate Terra Station wallet. PhishDestroy first observed the domain on 2026-10-23 and recorded an HTTP 200 response on that date. How the scam works Seed‑phrase theft sites masquerade as official cryptocurrency wallets and lure users to enter their 24‑word recovery phrase or download a compromised client. Capturing the seed phrase gives an attacker full control over any assets protected by that phrase. Evidence VirusTotal scanned the domain on 2026-10-22 and reported four detections across 92 engines, with one vendor labeling it malicious and three labeling it suspicious. Google Safe Browsing checked on 2026-10-23 and did not flag the site. URLScan captured the site on 2026-10-22 with a clean verdict, while a later capture on 2026-10-23 applied a malicious machine‑learning tag scoring 64. External blocklists MetaMask and SEAL listed the domain, Spamhaus DBL categorized it as spam, and OTX recorded three pulses referencing it; PhishDestroy also lists the domain internally as malicious. Infrastructure The domain was registered with NameSilo, LLC on 2026-09-17 and uses the nameservers ns1-sin.v-sys.org and ns2-sin.v-sys.org. DNS resolution returned the IP 91.239.77.41, a server recorded in Singapore and labeled “Protected”. The TLS certificate issued by Let’s Encrypt is valid from 2026-09-17 to 2026-12-16 for terrawallet.org and *.terrawallet.org. What to do Users should not enter any seed phrase or download software from terrawallet.org; if a phrase was entered, treat the wallet as compromised and move funds to a new, secure wallet. Organizations should block the domain terrawallet.org at the network perimeter and monitor outbound connections for any attempts to reach it. Security teams can cite the VirusTotal, URLScan, and blocklist findings when updating threat‑intel feeds or alerting users. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16675-8285-7238-b769-25774dca648e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/07dfc83b-433e-4854-a8ee-6a87ea150556 URLQuery report: https://urlquery.net/report/6ad9ca7b-f74e-4a16-ba39-11de37aa8c29 Stored capture screenshot: https://i.ibb.co/5x454m93/e4b7971bb8fe.png Cloudflare Radar screenshot (2026-10-23T02:31:08Z): https://screenshots.phishdestroy.io/cf/07dfc83b-433e-4854-a8ee-6a87ea150556.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/6ad9ca7b-f74e-4a16-ba39-11de37aa8c29.png URLScan screenshot (2026-09-18T00:58:05Z): https://screenshots.phishdestroy.io/us/01a0b205-2b24-7698-883e-0b5632df8bb8.png URLScan capture report: https://urlscan.io/result/01a0b205-2b24-7698-883e-0b5632df8bb8/ URLScan screenshot (2026-10-09T19:55:40Z): https://screenshots.phishdestroy.io/us/01a1223c-39b6-757f-9221-8fee284d8dcd.png URLScan capture report: https://urlscan.io/result/01a1223c-39b6-757f-9221-8fee284d8dcd/ URLScan screenshot (2026-10-14T08:36:17Z): https://screenshots.phishdestroy.io/us/01a1398e-0535-740a-a2a7-b99fb9f5deac.png URLScan capture report: https://urlscan.io/result/01a1398e-0535-740a-a2a7-b99fb9f5deac/ URLScan screenshot (2026-10-14T18:21:03Z): https://screenshots.phishdestroy.io/us/01a13ba5-622e-7318-92aa-5df0b22bddc5.png URLScan capture report: https://urlscan.io/result/01a13ba5-622e-7318-92aa-5df0b22bddc5/ URLScan screenshot (2026-10-22T10:45:57Z): https://screenshots.phishdestroy.io/us/01a16337-1b2f-76cd-9474-9dd247203b7a.png URLScan capture report: https://urlscan.io/result/01a16337-1b2f-76cd-9474-9dd247203b7a/ VirusTotal report: https://www.virustotal.com/gui/domain/terrawallet.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=terrawallet.org Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 02:38:17 UTC ## Stored page captures - Primary capture: https://i.ibb.co/5x454m93/e4b7971bb8fe.png Captured: 2026-10-23 01:53:29 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16675-8285-7238-b769-25774dca648e.png Captured: 2026-10-23 01:53:29 UTC Source report: https://urlscan.io/result/01a16675-8285-7238-b769-25774dca648e/ - URLScan capture 2: https://urlscan.io/screenshots/01a16337-1b2f-76cd-9474-9dd247203b7a.png Captured: 2026-10-23 01:33:26 UTC Source report: https://urlscan.io/result/01a16675-8285-7238-b769-25774dca648e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/07dfc83b-433e-4854-a8ee-6a87ea150556.png Captured: 2026-10-23 02:31:08 UTC Source report: https://radar.cloudflare.com/scan/07dfc83b-433e-4854-a8ee-6a87ea150556 SHA-256: 4da9ee61406edc09436868761dc7b5ed4c1eb042f3c4f53650db03e6f9d1c4f4 - URLQuery: https://screenshots.phishdestroy.io/uq/6ad9ca7b-f74e-4a16-ba39-11de37aa8c29.png Source report: https://urlquery.net/report/6ad9ca7b-f74e-4a16-ba39-11de37aa8c29 SHA-256: 836a8319576a76c69a2688e87de627ab7e3b96be0edc0580724d955a507f9ffb - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b205-2b24-7698-883e-0b5632df8bb8.png Captured: 2026-09-18 00:58:05 UTC Source report: https://urlscan.io/result/01a0b205-2b24-7698-883e-0b5632df8bb8/ SHA-256: e4e3439e6410005e779cecff44aebed2c11a6afb470da3d1057be2cd50b7145a - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a1223c-39b6-757f-9221-8fee284d8dcd.png Captured: 2026-10-09 19:55:40 UTC Source report: https://urlscan.io/result/01a1223c-39b6-757f-9221-8fee284d8dcd/ SHA-256: 7ef02647e615782e606edfa213144f66045002a424429a230eb16e3883227776 - URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a1398e-0535-740a-a2a7-b99fb9f5deac.png Captured: 2026-10-14 08:36:17 UTC Source report: https://urlscan.io/result/01a1398e-0535-740a-a2a7-b99fb9f5deac/ SHA-256: 4870e9cedc4b81e80900d9979d30dbbe436084e01f4ca655bcb843056fd4579c - URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13ba5-622e-7318-92aa-5df0b22bddc5.png Captured: 2026-10-14 18:21:03 UTC Source report: https://urlscan.io/result/01a13ba5-622e-7318-92aa-5df0b22bddc5/ SHA-256: 7ef02647e615782e606edfa213144f66045002a424429a230eb16e3883227776 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14f30-2906-74c0-8222-cdd9269ee6a4.png Captured: 2026-10-18 13:25:24 UTC Source report: https://urlscan.io/result/01a14f30-2906-74c0-8222-cdd9269ee6a4/ SHA-256: 7ef02647e615782e606edfa213144f66045002a424429a230eb16e3883227776 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16337-1b2f-76cd-9474-9dd247203b7a.png Captured: 2026-10-22 10:45:57 UTC Source report: https://urlscan.io/result/01a16337-1b2f-76cd-9474-9dd247203b7a/ SHA-256: 7ef02647e615782e606edfa213144f66045002a424429a230eb16e3883227776 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T02:00:47Z", "uuid": "01a16675-8285-7238-b769-25774dca648e", "scanned_at": "2026-10-23T01:52:26Z", "final_url": "https://terrawallet.org/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://terrawallet.org/", "from": "http://terrawallet.org/", "status": 307 } ], "ip": "91.239.77.41", "ptr": "dedicated.vsys.host", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.94", "2a00:1450:4001:c25::5f", "91.239.77.41" ], "asns": [ "15169", "43180" ], "countries": [ "US", "DE", "SG" ], "link_domains": [ "github.com" ], "social": [ "https://github.com/Terra-developments" ], "doc_hash": "92f6f48f8a2160ebe8665bef8b2d3cdf36ee42364b02b9997c9559fc31962da8", "script_hashes": [ "5602c098d97ccee9010fb11b60621bdcf88db98d33e992c5a59215ff3cc8578f", "a5d733a1577fb6be8a4ee249a2ca858dea4fddd6f3d58cb93c0afff2f40b57a7", "0ac8cb63c27d88c04212d11c8f79b383f74f55ce877e21382b9690d8349d0db6", "bead32fe65c5ea326c8c7552b93ff0f05ca457c4e36b4d458451c1cf1a76930d" ], "globals": [ "$R", "__TSR_ROUTER__", "__TSS_START_OPTIONS__" ], "tls": { "san": [ "*.terrawallet.org", "terrawallet.org" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "terrawallet.org", "protocol": "TLS 1.3", "valid_to": "2026-12-16T21:40:38Z", "valid_from": "2026-09-17T21:40:39Z" }, "domain_age_days": 1713, "apex_age_days": 1713, "tls_age_days": 35, "tls_valid_days": 89, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 64, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:37:11Z", "uuid": "07dfc83b-433e-4854-a8ee-6a87ea150556", "scanned_at": "2026-10-23T02:31:08Z", "final_url": "https://terrawallet.org/", "status": 200, "history": [ { "url": "https://terrawallet.org/", "status": 200 } ], "dom_hash": "50df524d4eec21041cec0f1ae0102c6e31d7db893592ed44e71e7620848e0a19", "doc_hash": "92f6f48f8a2160ebe8665bef8b2d3cdf36ee42364b02b9997c9559fc31962da8", "domain_risks": [ "Content Servers", "Technology" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "terrawallet.org", "type": "A", "value": "91.239.77.41" } ], "dnssec_valid": false, "ip": "91.239.77.41", "whois": { "registrar": "NameSilo, LLC", "created": "2026-09-17T20:41:54Z", "updated": "2026-09-22T20:42:20Z", "expires": "2027-09-17T20:41:54Z", "nameservers": [ "ns1-sin.v-sys.org", "ns2-sin.v-sys.org" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:30:02Z", "analysis_at": "2026-10-22T13:40:58Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 3, "undetected": 34 }, "detections": { "Fortinet": "spam", "Gridinsoft": "suspicious", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Cloudflare Radar": 1000000 }, "created": "2025-01-04T00:00:00Z", "updated": "2026-01-04T00:00:00Z", "first_seen": "2024-03-05T19:54:07Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "terrawallet.org", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns2-sin.v-sys.org" }, { "ttl": 21600, "type": "SOA", "rname": "monitoring.v-sys.org", "value": "ns1-sin.v-sys.org" }, { "ttl": 14400, "type": "A", "value": "91.239.77.41" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:213.111.158.253 +ip4:91.239.77.41 ~all" }, { "ttl": 21600, "type": "NS", "value": "ns1-sin.v-sys.org" }, { "ttl": 14400, "type": "TXT", "value": "google-site-verification=_nxOwePNp_yEJw5UGe2_8NTUID7lkEBHWktly5nXSC8" } ], "dns_at": "2026-10-22T13:41:19Z", "jarm": "29d29d15d29d29d00042d42d00000072e74222ce193a6f991becaa3da6c94d", "cert": { "san": [ "*.terrawallet.org", "terrawallet.org" ], "issuer": "Let's Encrypt / YR1", "serial": "5fc9898fdf55eb1c8dd0c0f7441b144554a", "sha256": "c039755170eeffd6ebdec64c99c65fbfb08658994ef1ccb6e358af9ea83c6ea9", "subject": "terrawallet.org", "valid_to": "2026-12-16T21:40:38Z", "valid_from": "2026-09-17T21:40:39Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-10-17T01:29:22Z", "registration": "2026-09-17T00:00:00Z", "registrar expiration": "2027-09-17T00:00:00Z", "last update of RDAP database": "2026-10-22T13:41:19Z" }, "registrar": "NameSilo, LLC", "registrar_iana_id": "1479" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:37:28Z", "mail_config": { "mx": [ "terrawallet.org" ], "spf": "v=spf1 +a +mx +ip4:213.111.158.253 +ip4:91.239.77.41 ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 2 }, "caa_records": { "domain": "terrawallet.org" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:37:30Z", "first": "2023-02-26T16:48:22Z", "changes": 6, "days_archived": 15, "scans_per_day": 0.01, "avg_page_bytes": 1944 }, "robots_txt": { "agents": [ "Googlebot", "Bingbot", "Twitterbot", "facebookexternalhit", "GPTBot" ], "present": true, "sitemaps": [ "https://terrawallet.org/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 20 }, "social_tags": { "ogUrl": "https://terrawallet.org/", "title": "Terra Station Wallet — Official Desktop Crypto Wallet", "ogType": "website", "robots": "index, follow, max-snippet:-1, max-image-preview:large", "ogImage": "https://terrawallet.org/social/terra-station-multi-chain-desktop-wallet-og.jpg", "ogTitle": "Terra Station Wallet — Official Desktop Crypto Wallet", "ogSiteName": "Terra Station", "themeColor": "#023DB5", "description": "Terra Station is the official non-custodial desktop wallet for Terra, LUNC and 30+ chains. Staking, Ledger support, easy import. Free for Windows, macOS, Linux.", "twitterCard": "summary_large_image", "canonicalUrl": "https://terrawallet.org/", "ogDescription": "Terra Station is the official non-custodial desktop wallet for Terra, LUNC and 30+ chains. Staking, Ledger support, easy import. Free for Windows, macOS, Linux." }, "trackers": { "requests": 10, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 5, "tls": 175, "wait": 320, "connect": 161, "download": 1 }, "response_ms": 662 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 39685, "co2_grams": 0.0015, "cleaner_than": 42 }, "dns_server": { "ns": [ { "ip": "213.111.158.253", "host": "ns2-sin.v-sys.org" }, { "ip": "213.111.158.253", "host": "ns1-sin.v-sys.org" } ], "zone": "terrawallet.org" }, "location": { "ip": "91.239.77.41", "asn": "43180", "org": "Protected", "city": "Singapore", "country": "SG" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "terrawallet.org" }, "dns": { "A": [ "91.239.77.41" ], "MX": [ "{\"exchange\": \"terrawallet.org\", \"priority\": 0}" ], "NS": [ "ns1-sin.v-sys.org", "ns2-sin.v-sys.org" ], "SOA": "{\"nsname\": \"ns1-sin.v-sys.org\", \"hostmaster\": \"monitoring.v-sys.org\", \"serial\": 2026092300, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "google-site-verification=_nxOwePNp_yEJw5UGe2_8NTUID7lkEBHWktly5nXSC8", "v=spf1 +a +mx +ip4:213.111.158.253 +ip4:91.239.77.41 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "91.239.77.41", "family": 4 }, "redirects": { "chain": [ "https://terrawallet.org" ] }, "subdomains": { "count": 11, "subdomains": [ "cms.terrawallet.org", "cs.terrawallet.org", "good.terrawallet.org", "imadmin.terrawallet.org", "job.terrawallet.org", "mdl.terrawallet.org", "planet.terrawallet.org", "plant.terrawallet.org", "terra1.terrawallet.org", "test.terrawallet.org", "www.terrawallet.org" ] }, "tech_stack": { "technologies": [ "Nginx", "Priority Hints", "Google Font API", "PWA", "Open Graph" ] }, "social_presence": { "profiles": [ "https://github.com/Terra-developments" ] }, "linked_pages": { "external": [ "https://github.com/Terra-developments" ], "external_count": 1, "internal_count": 20 }, "whois": { "registrar": "NameSilo, LLC", "created": "2026-09-17T20:41:54Z", "updated": "2026-09-22T20:42:20Z", "expires": "2027-09-17T20:41:54Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1-sin.v-sys.org", "ns2-sin.v-sys.org" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html" } } } } ```