mdgamings[.]site

PhishDestroy identifies mdgamings.site as an active crypto drainer scam site under investigation. Current threat status remains active as the domain continues to resolve to malicious infrastructure, actively targeting cryptocurrency users. The domain mdgamings.site exhibits multiple indicators of compromise, including a crypto drainer payload designed to illicitly transfer digital assets from unsuspecting victims. This domain was flagged by 21 of 95 VirusTotal vendors as of the latest scan, indicating it remains undetected by most antivirus engines. Registered through Dynadot Inc on April 02, 2026, the domain resolves to IP address 91.218.49.169 and operates under a Let's Encrypt SSL certificate, which adds a false sense of legitimacy. Despite its recent creation, the domain has not yet been widely blacklisted, with zero detections across multiple threat intelligence platforms. Given the absence of vendor detections and the domain's active status, the risk level remains under investigation but poses a credible threat to cryptocurrency users. Technical indicators include the use of a recently registered domain (RR domain) and hosting on a bulletproof infrastructure IP. The SSL certificate further enables evasion of security controls that rely on certificate reputation checks. Immediate action is recommended: block the domain at the network perimeter, update DNS sinkholes, and monitor for connections to IP 91.218.49.169. Users should be warned against interacting with the domain and encouraged to verify URLs via trusted sources before engaging in transactions. Additionally, consider reporting the domain to threat intelligence platforms to improve detection coverage.