terawex[.]com

PhishDestroy identifies terawex.com as an active crypto drainer command-and-control server under the unique seed 08c67d. This domain operates as a generic phishing vector with a current risk level of "under_investigation" but shows clear indicators of malicious activity.

This domain was flagged with a 9/95 detection rate on VirusTotal as of the investigation window, indicating it remains undetected by most antivirus engines. The domain resolves to IP address 188.114.96.3 and was registered through Hello Internet Corp on March 18, 2026. The presence of a Let's Encrypt SSL certificate suggests an attempt to establish legitimacy, while the lack of blocklist inclusion at this stage reflects its novelty or evasion techniques. The domain's recent creation and low detection profile emphasize the need for immediate scrutiny.

Organizations and individuals should immediately block terawex.com at the network and DNS levels due to its association with crypto drainer infrastructure. Users interacting with this domain risk unauthorized cryptocurrency transfers via injected JavaScript or deceptive wallet connection prompts. If exposure is suspected, disconnect from untrusted networks, revoke any connected wallet permissions, and scan systems using updated endpoint protection. Report the domain to threat intelligence platforms and financial institutions to prevent further abuse.