infernodrainer[.]ru

Analysis indicates that the domain infernodrainer.ru is actively associated with a crypto drainer scam, as explicitly identified by its page title 'Inferno Drainer - Unleash the Flames' and classified under the scam type 'Crypto Drainer.' The domain was registered on February 21, 2026, through the .ru TLD registry and is currently resolving to the IP address 198.251.89.220, hosted under AS53667 (FranTech Solutions) in the United States. Infrastructure analysis reveals the use of nameservers ns27.my-control-panel.com and ns28.my-control-panel.com, which may be part of a broader malicious hosting pattern, though this is not conclusive on its own. The domain is flagged by six security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence. It appears on one security blocklist and is blocked by at least one threat intelligence feed, including a pulse in AlienVault OTX. The domain's MX records point to itself, which is atypical for legitimate services and may indicate an attempt to intercept or spoof email communications. A 307 HTTP status suggests temporary redirection, which could be used to obscure the final destination or evade detection. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Technologies detected on the domain include LiteSpeed and HTTP/3, which are not inherently malicious but are consistent with modern web infrastructure that could support dynamic or obfuscated content delivery. The domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. While the exact content and functionality of the site have not been fully analyzed, the available evidence strongly suggests it is designed to facilitate cryptocurrency theft, likely by tricking users into connecting wallets or authorizing transactions.