drugtestall[.]com

Analysis indicates that the domain drugtestall.com was registered through NameCheap, Inc. on September 15, 2011 and continues to resolve to the IPv4 address 158.94.209.40 via the authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. The domain is currently classified as a generic phishing operation with a high risk rating and remains active as of the report date, July 21, 2026. Independent threat intelligence sources have observed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service. VirusTotal scanning shows that two of ninety‑five security vendors have flagged the domain, providing limited but corroborating evidence of malicious intent.

The limited detection count suggests that the campaign may be employing a low‑profile hosting arrangement or that the malicious payload has not yet been widely distributed. Defenders should consider adding the IP address 158.94.209.40 to network‑level deny lists and ensure that any outbound connections to the domain are intercepted. Continuous monitoring of the domain’s DNS records is recommended, as changes to the nameserver configuration could indicate an escalation of the campaign.

Correlation with other indicators of compromise, such as email subjects or attachment hashes associated with the same phishing kit, may reveal additional victims. Given the high‑risk designation and the presence on an active blocklist, organizations are advised to treat any traffic to drugtestall.com as malicious and to enforce strict email filtering rules that block URLs pointing to the domain. Ongoing review of threat‑intel feeds for new detections will help maintain situational awareness as the campaign evolves.