panedhkw[.]com

PhishDestroy identifies panedhkw.com as a live cryptocurrency drainer site first catalogued under seed 805c4b. The domain masquerades as a benign redirect endpoint while surreptitiously loading malicious drainer kits aiming to empty victims’ digital wallets. No overt branding is leveraged, indicating a generic but highly targeted campaign against crypto users. The payload is delivered through a transparent redirection chain that terminates at the malicious endpoint hosted on 180.178.160.59. This domain was flagged by only 2 of 95 VirusTotal security vendors, underlines its stealthy deployment. Key technical indicators include registration via Hosting Concepts B.V. d/b/a Registrar.eu, a Let’s Encrypt SSL certificate for added legitimacy, an IP resolution to 180.178.160.59, and a creation timestamp of May 10, 2026. The domain carries no known presence in Google Safe Browsing and has not yet accrued mass blocklist coverage, enabling continued operation. As of today, panedhkw.com remains active and resolves to the malicious infrastructure. Immediate mitigation includes network-level blocking of both the domain and its resolving IP. Users should treat any interaction with this site as a high-risk cryptocurrency theft attempt. Remaining risk remains high while the domain continues to operate undetected by most vendors and blocklists.