goldendrainer[.]top

goldendrainer.top was registered through NameCheap on 21 February 2026 and is hosted on Cloudflare’s AS13335 network in the United States, resolving to 172.67.219.160. The domain resolves to an Nginx/OpenResty stack and presents a TLS certificate issued by Let’s Encrypt (R12). The sole page title returned by the HTTP response is “Redirecting…”. Intelligence sources indicate the site was used for a crypto‑drainer phishing campaign; the classification “Crypto Drainer” appears in the provided data. The domain is listed on one security blocklist and has been blocked by the PhishDestroy feed.

VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. MX records point to mx.plingest.com with priority 10, suggesting a functional mail service that could be leveraged for credential harvesting. Gridinsoft assigned a trust score of 0 out of 100, confirming the lack of legitimacy. The domain’s nameservers are dns101.registrar-servers.com.

and dns102.registrar-servers.com., both typical of the registrar’s default configuration. As of the report date, the site is taken offline, but the infrastructure—particularly the Cloudflare edge IP and the Let’s Encrypt certificate—remains reusable for future campaigns. Defenders should add 172.67.219.160 to network‑level deny lists, monitor DNS queries for goldendrainer.top and its authoritative nameservers, and enforce email filtering for messages originating from mx.plingest.com. Continuous threat‑intel feeds should be consulted for any re‑registration of the domain or similar patterns targeting crypto‑related victims.