srtydnnc[.]beer

srtydnnc.beer was registered on 2026-06-03 through Dynadot Inc and resolves to IP 178.16.52.101, an address allocated to Omegatech LTD in Germany. DNS resolution uses Cloudflare authoritative nameservers (armando.ns.cloudflare.com, laylah.ns.cloudflare.com). The site serves HTTPS with a publicly‑signed certificate (Let’s Encrypt, YR1) and presents an Nginx server banner with HTTP Strict Transport Security enabled. All HTTP requests return a 403 status code and the only visible page title reported by scanners is “Server Offline”, indicating that the landing page is currently inaccessible. Intelligence tags the domain as a crypto‑drainer phishing operation. Reputation metrics are extremely negative: Gridinsoft assigns a trust score of 0/100, three independent security blocklists have listed the domain, and VirusTotal analysis shows 17 of 91 scanners flagging it as malicious. The domain is already blocked by multiple anti‑phishing and wallet‑security solutions. Although the specific phishing lure and payload have not been captured, the recent creation date, low trust rating, active blocklisting, and explicit “crypto drainer” classification strongly suggest an active campaign aimed at extracting cryptocurrency assets. Defenders should enforce DNS‑level denial of the domain, add the IP address to network‑level deny lists, and ensure endpoint detection signatures incorporate the observed TLS fingerprint and HTTP 403 response pattern. Continuous monitoring is advised to detect any future changes to the site’s content or infrastructure.