pandefi[.]co

This domain, pandefi.co, is under investigation as a crypto drainer phishing site. Infrastructure analysis reveals the domain was registered on February 21, 2026, and is currently offline. The page title recorded is 'pandefi.co,' with no additional brand or visual details confirmed at this time.

Known intelligence indicates the domain appears on two security blocklists and is blocked by PhishDestroy and ScamSniffer, which classify it as a crypto scam. No detections were reported by the 93 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. Defenders should treat this domain as high-risk for cryptocurrency-related fraud.

Recommended actions include blocking the domain at the network level, monitoring for related IOCs (e.g., wallet addresses, associated IPs), and alerting users to potential exposure if interaction with the domain is detected. Further analysis is required to determine the full scope of the campaign, including any linked infrastructure or wallet addresses used in the drainer operation. Given the domain's current offline status, defenders should prioritize historical log reviews to identify past interactions and prevent recurrence.