zenarex[.]com

PhishDestroy identifies zenarex.com as a live cryptocurrency drainer site deployed to siphon digital assets from unsuspecting wallet holders. The domain exhibits clear malicious intent, leveraging deceptive landing pages that impersonate legitimate crypto services to trick victims into connecting wallets and signing malicious transactions. No specific brand is mimicked in the current payload, indicating an opportunistic campaign designed to harvest private keys and drain funds directly. The infrastructure supports automated transaction signing, characteristic of modern drainer kits observed in underground forums during Q2 2026.

This domain was flagged through passive DNS correlation and behavioral analysis. Technical indicators confirm: VirusTotal detection score of 8/95 as of April 03, 2026; registered via Fewmoretaps OU (d/b/a Trustname.com); resolving to IP 188.114.96.3; domain created on April 01, 2026 with a 2-day age at first sighting; SSL certificate issued by Let’s Encrypt (CN=zenarex.com); Google Safe Browsing status currently unlisted (0 blocklists); and no prior reputation in threat intelligence feeds. The IP 188.114.96.3 is part of a known bulletproof hosting range associated with multiple drainer campaigns. WHOIS data is privacy-protected, consistent with short-lived malicious domains.

zenarex.com remains ACTIVE and is actively serving malicious JavaScript payloads via a spoofed interface. Immediate takedown has not been observed; the domain continues to resolve and serve content. No active blocking by major browsers or security vendors is currently in place. Remaining risk is HIGH due to the drainer’s ability to execute unauthorized transactions upon wallet connection. Users are advised to avoid visiting zenarex.com, block the domain and IP at network level, and inspect wallet connection requests for suspicious domains. Security teams should monitor for similar domains registered post-April 01, 2026 with identical hosting infrastructure.