pearwex[.]com

This domain, pearwex.com, is flagged as a generic phishing infrastructure designed to impersonate login portals for brand authentication. Analysis indicates no direct association with a specific drainer kit or cryptocurrency wallet theft, but the presence of Facebook Pixel and Twitter Ads tracking technologies suggests credential harvesting for account takeover or fraudulent transactions. The domain exhibits characteristics of a broad-spectrum phishing campaign, likely targeting users of cloud-based services given its Cloudflare-hosted infrastructure and Google Trust Services SSL certificate. Infrastructure analysis reveals concrete technical indicators: the domain was created on June 07, 2026, through registrar Fewmoretaps OU d/b/a Trustname.com. It is detected by 14 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is referenced in four threat intelligence pulses. The SSL certificate is issued by Google Trust Services, and the domain is currently offline. Technologies detected include Cloudflare, Cloudflare Browser Insights, Facebook Pixel, and Twitter Ads, which are atypical for legitimate login portals and suggest data exfiltration capabilities. Current status shows the domain has been taken offline, likely in response to detection by security blocklists and threat intelligence platforms. However, residual risk remains elevated due to the domain's recent creation date and the use of legitimate-seeming SSL certificates and CDN services to evade detection. Users who interacted with the domain prior to its takedown should immediately revoke any entered credentials, enable multi-factor authentication on associated accounts, and monitor for unauthorized access. Organizations should update blocklists to include this domain and investigate logs for connections to its IP addresses to identify compromised endpoints.