tr[.]padisahbet-giris2026[.]org

tr.padisahbet-giris2026.org is an active crypto drainer domain impersonating a gaming platform, posing an elevated risk to cryptocurrency users. This site was designed to trick visitors into connecting wallets and draining funds under the guise of a legitimate Turkish betting service ('padisahbet-giris2026'). The threat actor leverages spoofed branding and urgency to harvest private keys and authorize malicious transactions. Security researchers and users should treat this domain with extreme caution and avoid all interactions involving wallet connections or fund transfers.

This domain was flagged by PhishDestroy and confirmed through multiple intelligence sources. It resolves to IP 104.21.22.105, uses a Let’s Encrypt SSL certificate, and was registered on May 07, 2026 through Squarespace Domains LLC. VirusTotal reports 7 out of 95 security vendors detecting malicious activity. The domain is currently blocked by OpenPhish and appears on one public blocklist, indicating confirmed malicious reputation. Despite using a reputable registrar and a valid SSL certificate, these factors do not mitigate the active crypto drainer threat.

Users should immediately block tr.padisahbet-giris2026.org at the network and DNS level. Never connect a cryptocurrency wallet or enter credentials on this site. If funds were drained, report the incident to local law enforcement and your wallet provider. Share indicators of compromise with threat intelligence platforms. Organizations should deploy endpoint protection to detect wallet-draining scripts and block this domain via firewall rules or DNS filtering services.