drainer[.]tander[.]top

Analysis of drainer.tander.top shows a short‑lived crypto‑drainer phishing infrastructure that has been taken offline as of the report date, July 22 2026. The domain is registered through Dynadot LLC and resolves to IP 199.191.50.82, which is hosted in the United States and associated with AS40034 Confluence Networks Inc. The web server presents an SSL certificate identified as version R13 and returns an HTTP 200 response, indicating that the site was reachable and serving content before shutdown. Page metadata reveals a title of “Verification,” consistent with the generic verification step often used in credential‑harvesting flows, and the underlying stack includes Google Cloud services, an Nginx front end, and Google Cloud CDN, suggesting the attacker leveraged cloud resources for rapid deployment. VirusTotal recorded a single positive detection out of 94 scanning engines, confirming that at least one security vendor flagged the domain as malicious.

The domain is listed on one public blocklist and is actively blocked by PhishDestroy, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Nameservers 5642.ns1.abovedomains.com. and 5642.ns2.abovedomains.com.

are configured, and the MX record points to park-mx.above.com with priority 10, a typical placeholder for parked domains. Defenders should update internal threat feeds with the observed indicators, block the IP address 199.191.50.82 and the domain drainer.tander.top at DNS and proxy layers, and monitor for any re‑registration attempts or similar sub‑domains using the same registrar or hosting provider. Continuous observation of threat intel sources for new detections related to the Crypto Drainer campaign is recommended, as the offline status does not preclude future re‑use of the infrastructure.