terrastress[.]st

PhishDestroy identifies terrastress.st as a generic phishing domain currently flagged as active and under investigation for hosting a fake login portal. The domain is not yet detected by 1 of 95 VirusTotal vendors, indicating a low initial detection rate despite suspicious infrastructure. Registrar data shows registration through StanCo and Istanco, with resolution to IP 185.11.145.254 and a Let's Encrypt SSL certificate issued for the domain created on April 18, 2026.

This domain exhibits multiple red flags commonly associated with credential harvesting operations. It resolves to IP address 185.11.145.254, which has no established reputation in threat intelligence feeds. The domain was registered through StanCo and Istanco, registrars known to have lax oversight allowing bulk malicious registrations. With a VirusTotal detection rate of 1 out of 95 vendors, this domain has evaded initial automated detection despite being active. The Let's Encrypt certificate suggests the threat actor is attempting to establish trust through legitimate-looking HTTPS encryption, while the domain name terrastress.st implies potential impersonation of legitimate stress-testing or cryptocurrency platforms.

Given the active status and under-investigation classification, users should treat terrastress.st as a high-risk domain until further analysis is completed. PhishDestroy recommends verifying this domain through its threat intelligence database before any interaction. Users who have already visited this domain should change passwords used on the site and enable multi-factor authentication on all accounts that may have been exposed. Security teams should block IP 185.11.145.254 at the network perimeter and monitor for any connections to this domain. The combination of low VirusTotal detection, recent domain creation, and suspicious registrar choice indicates this is likely an emerging threat that requires immediate attention from both individual users and organizational security teams.