drainer[.]chat

Analysis of drainer.chat shows that the domain was registered on February 21, 2026 through Name.com, Inc. and is currently taken offline. DNS resolution points to 94.156.170.207, an address allocated to PLAY2GO INTERNATIONAL LIMITED in Germany (AS215439). The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating use of Vercel’s DNS service. No TLS certificate was observed, meaning the site was served only over HTTP.

An HTTP request returned a 404 status code and the page title reported by the scanner was “invokergame”, which does not correspond to any known legitimate service. The domain appears on a single public blocklist and has been specifically flagged by the PhishDestroy blocklist. VirusTotal scans recorded detections from two of ninety‑three security vendors, providing independent confirmation of malicious intent. The limited detection footprint, combined with the absence of a valid certificate and the 404 response, suggests the site was likely used for a short‑lived phishing campaign before being shut down.

Because the hosting provider is Vercel, the same infrastructure could be reused for other malicious domains. Defenders should continue to block the domain and its IP address, monitor for future registrations of similar sub‑domains under the same nameserver set, and consider adding the IP range to outbound filtering rules. Threat intelligence feeds should be updated to reflect the confirmed phishing nature of drainer.chat, and any residual URLs observed in email or messenger traffic should be treated as malicious.