rtgsdefi[.]com

This domain, rtgsdefi.com, is flagged as an active crypto drainer threat with a high risk level. Registered on February 21, 2026, through Hetzner Online GmbH, it resolves to IP address 95.216.162.7, hosted on AS24940 Hetzner Online GmbH in Finland. The domain is currently active, returning an HTTP status of 200, and its page title is SEPT Platform - System of Electronic Payments Token, indicating it impersonates a financial token platform. Infrastructure analysis reveals nameservers ns.second-ns.com, ns1.your-server.de, and ns3.second-ns.de, along with an MX record pointing to www4.your-server.de. The SSL certificate is issued by Let's Encrypt (E7), and technologies detected include Nginx, HSTS, and Google Analytics. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of confidence in the domain's legitimacy. VirusTotal reports that 5 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. AlienVault OTX includes this domain in one threat intelligence pulse, and it is blocked by PhishDestroy. The exact nature of the crypto drainer—whether it involves wallet connection prompts, token approvals, or other deceptive mechanisms—is not specified in the available data. Defenders should treat this domain as an active threat, block access at the network level, and monitor for any associated subdomains or IP changes. Users who may have interacted with the site should be advised to revoke any token approvals and avoid connecting wallets. Further analysis of the site's content and payload is recommended to identify the specific drainer kit and any additional infrastructure. The combination of a low trust score, multiple vendor flags, and its inclusion in threat intelligence feeds strongly supports treating rtgsdefi.com as a confirmed malicious domain targeting cryptocurrency users.