panelferno[.]com

This domain, panelferno.com, was registered on 2026-03-03 through NiceNIC International Group Co., Limited and is currently offline. The site presented the page title “Login | Inferno Drainer,” indicating a crypto drainer scam. No TLS certificate was observed, meaning any credentials submitted would have been transmitted unencrypted. The domain resolves to the Cloudflare edge IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Nameservers are ganz.ns.cloudflare.com and isla.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

VirusTotal analysis shows that three of ninety‑four security vendors flagged the domain, providing modest corroboration of malicious intent. The domain appears on a single blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing infrastructure. The risk level is marked elevated, and the threat type is recorded as generic phishing with a specific crypto drainer focus. Because the site is offline, active probing is not possible, and the current HTTP status cannot be verified.

However, the available evidence is sufficient for defenders to implement preventive controls. Recommendations include adding panelferno.com to domain blocklists, denying traffic to its IP address 188.114.97.3, and monitoring for newly created domains that resolve to the same Cloudflare nameservers or IP range. Continuous observation of the registrar NiceNIC International Group Co., Limited for similar registrations may also help anticipate future campaigns. Until the domain is taken down completely, security teams should treat any attempted connections as malicious.