btcpay390087[.]lndyn[.]com

The domain btcpay390087.lndyn.com has been identified as a crypto drainer phishing site, designed to harvest cryptocurrency wallet credentials and siphon digital assets. Analysis indicates the domain is currently offline, though prior activity suggests it was actively targeting users through fraudulent payment or wallet interfaces. The threat type aligns with tactics used to exploit victims by mimicking legitimate cryptocurrency services, prompting users to connect wallets or enter private keys, which are then drained by automated scripts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 172.81.182.91. It is flagged by 3 of 95 security vendors on VirusTotal, holds a Gridinsoft trust score of 0 out of 100, and appears on at least one security blocklist. Technologies detected include Bootstrap, Vue.js, Nginx, Moment.js, jQuery, HSTS, and Clipboard.js, which are often leveraged to create convincing, interactive phishing pages. The page title, '429 - Too Many Requests,' suggests either a temporary error state or an attempt to evade automated detection by throttling requests. Current status confirms the domain has been taken offline, likely due to enforcement actions or the conclusion of the campaign. However, the infrastructure remains a potential risk for future malicious activity. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who interacted with the domain should immediately revoke any wallet permissions granted, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Security teams should treat this domain as part of a broader pattern of crypto drainer operations and update detection rules accordingly.