servicodtrn-es[.]online

PhishDestroy identifies servicodtrn-es.online as an active crypto drainer domain impersonating ServiceDTRN. This domain was flagged as a generic phishing campaign targeting cryptocurrency users through deceptive ServiceDTRN branding. The threat involves a crypto drainer kit designed to siphon funds from unsuspecting victims by mimicking legitimate ServiceDTRN interfaces or transaction prompts. No known drainer kit signatures were detected in public sandboxes at the time of analysis, suggesting a newly deployed or obfuscated payload. This domain resolves to IP 172.67.221.154 and was registered through GoDaddy.com, LLC on April 24, 2026. VirusTotal currently reports 0/95 detections, indicating low signature coverage. The SSL certificate is issued by Let's Encrypt, which is commonly exploited in phishing campaigns due to its automated issuance process. As of this report, this domain has not been blocklisted by major threat intelligence platforms, including Google Safe Browsing (GSB status: unclassified). The combination of a newly registered domain, low detection rates, and the use of a trusted SSL issuer highlights elevated risk potential. Current status is active with no confirmed takedown actions. PhishDestroy advises immediate verification of URLs and avoidance of any interactions with servicodtrn-es.online. Users should cross-reference domains against PhishDestroy’s threat database and report suspicious activity. Remaining risk is high due to undetected status on major platforms and the domain’s recent registration. Proactive monitoring and network-level blocking are recommended to mitigate exposure.