bstrminer[.]com

This domain, bstrminer.com, is flagged as an active crypto drainer phishing site targeting cryptocurrency users. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The site currently resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), which is commonly used to obscure the true origin of malicious infrastructure. The HTTP response code is 200, suggesting the server is operational, though the page title displays a '522: Connection timed out' error, which may indicate deliberate evasion or backend instability. Infrastructure analysis reveals the domain uses nameservers expire1.gname-dns.com and expire2.gname-dns.com, further linking it to the same registrar's DNS services. The absence of an SSL certificate is notable, as most legitimate financial or crypto-related sites enforce HTTPS. Security vendors have detected this domain, with one out of ninety-five flagging it on VirusTotal, and it appears on at least one security blocklist. The Gridinsoft trust score of 35 out of 100 aligns with the classification of a high-risk domain, though the exact mechanics of the crypto drainer payload remain unconfirmed. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. The use of Cloudflare hosting complicates attribution, but the domain's registration details and nameserver configuration provide actionable indicators for detection rules. Given the '522' error, the site may be in a transitional state, either preparing for a new campaign or temporarily disrupted. Monitoring for changes in page content or SSL implementation could provide additional context, though the current evidence supports immediate mitigation. Organizations handling cryptocurrency transactions should alert users to avoid interaction with this domain.