drainerless[.]xyz

The domain drainerless.xyz was registered on February 21 2026 through NameCheap, Inc. and is currently hosted behind Cloudflare’s network (AS13335). DNS resolution returns the IP address 104.21.2.27, and the authoritative nameservers are alice.ns.cloudflare.com and kurt.ns.cloudflare.com. The site presents a page titled “DrainerLESS | Secure Asset Rescue”, which aligns with the observed “Crypto Drainer” scam type. VirusTotal analysis shows that 2 of 95 scanned security vendors flag the domain as malicious, and the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of abuse. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Technical fingerprints include Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, while the SSL certificate is identified as WE1. While the observable infrastructure confirms the presence of a phishing landing page that purports to rescue cryptocurrency assets, no direct evidence of credential‑stealing forms, malicious payload delivery, or command‑and‑control endpoints has been disclosed. The operator’s identity, the specific phishing kit used, and any associated email or social‑media distribution vectors remain unknown, limiting the ability to attribute the campaign beyond the domain’s hosting characteristics. Defenders should immediately block drainerless.xyz and its resolved IP 104.21.2.27 at network perimeter and DNS layers. Continuous monitoring of Cloudflare‑hosted IP ranges for similar page titles or SSL certificate patterns can help detect replicas. Organizations that handle cryptocurrency transactions should educate users about unsolicited “asset rescue” offers and enforce multi‑factor authentication to mitigate credential compromise.