texwallet[.]org

The domain texwallet.org has been identified as a crypto drainer specifically designed to target users of TRON-based decentralized finance (DeFi) platforms. Analysis confirms this infrastructure was actively impersonating the legitimate TEX Wallet service, presenting itself as a "Secure Crypto Wallet for TRON & DeFi" to deceive victims into connecting compromised wallets. Current status indicates the domain has been taken offline, though residual risk persists due to potential redeployment of associated infrastructure. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on September 30, 2025, and resolved to the IP address 199.36.158.100. Security telemetry shows the domain appears on one blocklist, while VirusTotal records indicate detection by 1 of 95 security vendors. The page title explicitly referenced TEX Wallet branding, suggesting a targeted campaign against users familiar with TRON ecosystem services. Creation date and hosting patterns align with common crypto drainer deployment timelines observed in recent threat actor operations. While texwallet.org is currently offline, organizations should maintain vigilance against this threat infrastructure. Recommended actions include monitoring for DNS resolution attempts to 199.36.158.100, implementing web filtering rules for the domain, and educating users about the risks of connecting wallets to unverified DeFi interfaces. Security teams should also review logs for connections to this IP or domain from September 30 onward, as compromised systems may require remediation. The combination of brand impersonation and crypto-draining functionality warrants continued tracking of this infrastructure.