webtrader[.]glamorsyx-trenls[.]com

Analysis of webtrader.glamorsyx-trenls.com indicates a high-risk crypto drainer phishing domain. The domain was registered on August 8, 2025, through Tucows, and is currently active with an HTTP 200 status. It resolves to 199.91.221.118, hosted in the Netherlands under BL Networks, and uses Cloudflare nameservers (heather.ns.cloudflare.com, sid.ns.cloudflare.com). Detected technologies include Skolengo, MariaDB, Java, Apache Tomcat, and Nginx, though their specific roles in the phishing operation remain unconfirmed. The SSL certificate is issued by Sectigo Limited, a common provider for both legitimate and malicious domains, offering no definitive trust signal. Security vendors have flagged this domain: 13 of 91 engines on VirusTotal detect it as malicious, and it appears on three blocklists, including MetaMask and SEAL. The page title 'Webtrader' aligns with cryptocurrency trading interfaces, consistent with the reported crypto drainer classification. No legitimate brand association is confirmed, and the exact content or targeting methods remain unverified due to lack of direct analysis. Defenders should treat this domain as active and malicious. Block resolution at the DNS level, monitor for connections to 199.91.221.118, and alert users attempting to access it. Further investigation into associated wallet addresses or transaction patterns is recommended to disrupt financial theft operations.