h5[.]tcpcredit[.]org

This domain, h5.tcpcredit.org, is identified as a crypto drainer phishing site targeting users of cryptocurrency platforms. Analysis of the page title, "tcpcredit," and associated infrastructure suggests an attempt to impersonate legitimate credit or lending services within the crypto ecosystem, likely to harvest credentials or initiate unauthorized transactions. No specific drainer kit branding was confirmed, but the domain’s behavior aligns with known crypto asset theft tactics. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 24, 2026, through Global Domain Group LLC and resolves to the IP address 91.200.221.21. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and is assigned a trust score of 0/100 by Gridinsoft. Technologies detected on the site include Nginx, HSTS, and HTTP/3, which may be used to enhance perceived legitimacy or evade detection. As of the latest verification, h5.tcpcredit.org has been taken offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future phishing campaigns. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the legitimacy of any linked services. Organizations should maintain blocklist entries for the domain and associated IP to mitigate potential re-emergence of this threat.