app[.]gthrkxdm[.]top

PhishDestroy identifies app.gthrkxdm.top as an active crypto-drainer phishing domain impersonating a generic Download page. The domain serves malicious payloads designed to drain cryptocurrency wallets under the guise of a legitimate download process. No specific brand has been directly impersonated in the observed payload, but the lure mimics common trojanized installer tactics used by crypto-draining kits such as PeckShield’s Angel Drainer or Inferno Drainer derivatives. The threat actor’s infrastructure is actively hosted and continues to operate without takedown intervention, indicating ongoing malicious intent with potential for further evolution in evasion techniques.

This domain exhibits multiple technical red flags validated through forensic analysis. It resolves to IP 188.114.97.3 and is registered via NameSilo, LLC. The domain was created on December 23, 2025—indicating a highly recent registration likely intended for short-lived campaigns. Notably, despite zero detections on VirusTotal (6/95), the domain holds an SSL certificate issued by Google Trust Services, which may be abused to establish trust with potential victims. The domain remains unlisted on Google Safe Browsing (GSB) and has not appeared on major blocklists such as PhishTank or OpenPhish at the time of analysis. This combination of fresh registration, low detection, and trusted SSL infrastructure suggests a sophisticated and well-prepared threat actor leveraging the trust of widely used registrars and certificate authorities.

As of the latest assessment, app.gthrkxdm.top remains active and continues to operate without interruption. Immediate response actions include domain takedown requests via NameSilo abuse channels, SSL certificate revocation through Google Trust Services, and IP-based blocking at the network perimeter. Security teams are advised to update browser blocklists, monitor DNS resolution to 188.114.97.3, and educate users to avoid downloading files from unknown sources. Although the immediate risk is classified as 'under investigation,' the absence of detections and active infrastructure pose a critical threat to cryptocurrency users. Continuous monitoring and proactive threat hunting are essential to mitigate potential wallet drain incidents. This domain should be treated as hostile and blocked by default in corporate and personal security policies.