dornrendthal[.]live

PhishDestroy identifies dornrendthal.live as an active crypto-draining phishing site posing as a legitimate service. The domain is currently operational and engages in fraudulent activities designed to deceive users into surrendering cryptocurrency assets or sensitive credentials. This specific threat involves malicious actors leveraging the domain to impersonate trusted financial or investment platforms, with the ultimate goal of draining victim wallets through fraudulent transactions or credential theft.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but confirmed malicious activity. It resolves to IP address 172.67.165.221, is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was created on May 11, 2026. The domain utilizes a Let's Encrypt SSL certificate, which enhances its appearance of legitimacy but provides no real security to users. These technical indicators, combined with the domain's recent creation and minimal detection rate, suggest a potentially emerging threat vector that may rapidly escalate in scope and sophistication.

The current status of dornrendthal.live remains active, and users are strongly advised against interacting with the domain in any capacity. Given the crypto-draining nature of this phishing site, any engagement could result in irreversible financial loss. PhishDestroy recommends immediate domain blocking at the network level and urges users who may have already visited the site to review their cryptocurrency wallet security, revoke any exposed credentials, and monitor financial accounts for unauthorized activity. This domain should be treated as a confirmed threat to digital asset safety and reported to relevant cybersecurity authorities for takedown.