terravault.finance: Confirmed Phishing Site

The domain terravault.finance was registered on May 24, 2026 through Hostinger operations, UAB. The site returns an HTTP 301 response and presents a TLS certificate issued by Let’s Encrypt (R13). The page title observed is “AtlasQ | Algorithmic Portfolio Intelligence,” a title that mimics legitimate financial analytics services. Infrastructure analysis shows the domain resolves to the IP address 145.79.25.1, which is located in Malaysia and belongs to Hostinger International Limited. The host’s Gridinsoft trust score is 0 out of 100, and two of ninety‑five security vendors on VirusTotal have flagged the domain as malicious. The domain is presently listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. While the available intelligence confirms the presence of a phishing‑style landing page, the limited number of vendor detections leaves open the possibility of additional undetected malicious components. No further indications of credential harvesting mechanisms, malware payloads, or command‑and‑control infrastructure have been observed beyond the page title and redirection behavior. Defenders should block DNS resolution for terravault.finance at the network perimeter and enforce HTTPS inspection to capture the initial 301 redirect. Email security gateways should be updated to flag any messages containing links to this domain, and incident response teams should monitor for credential submissions that resemble the AtlasQ branding. Continuous re‑evaluation of VirusTotal detections and blocklist status is advised to capture any escalation in malicious activity.