drainer[.]tan-der[.]top

This domain, drainer.tan-der.top, was registered on February 21, 2026 through NameSilo, LLC and immediately began serving a generic phishing payload that was later taken offline. The site presented a page title of “Problem loading page” and did not present an SSL certificate, indicating that any credential capture would have occurred over clear‑text HTTP. Infrastructure analysis shows the domain resolves to the IP address 147.124.214.12, which is hosted in the United States by Majestic Hosting Solutions, LLC (AS396073). The web server is identified as LiteSpeed with HTTP/3 support, and the authoritative nameservers are ns22.smartwebng.com.

and ns21.smartwebng.com. Trust scoring from Gridinsoft assigned a rating of 0 out of 100, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal records indicate that one of ninety‑five scanning engines flagged the domain, providing additional corroboration of its malicious nature.

Because the site is currently offline, active exploitation is not observed, but the underlying infrastructure remains under the control of the same hosting provider and may be reused for future campaigns. Defenders should add the IP 147.124.214.12 to network‑level deny lists, monitor the associated nameservers for newly created sub‑domains, and ensure that any outbound connections to this host are logged and inspected. Continuous re‑scanning of the domain through VirusTotal or similar aggregators is recommended to capture any changes in detection status. Organizations should also enforce strict TLS‑only policies to mitigate the risk of clear‑text credential submission on similar domains lacking valid certificates.