drughub666py6fgnml5kmxa7fva5noppkf6wkal4fwwvzwt4rz645aqd[.]top

The domain drughub666py6fgnml5kmxa7fva5noppkf6wkal4fwwvzwt4rz645aqd.top has been identified as a crypto drainer phishing threat, specifically designed to trick users into connecting their cryptocurrency wallets and approving malicious transactions that drain funds. This domain is currently offline, but its infrastructure and indicators remain a concern for ongoing monitoring.

PhishDestroy analysis reveals that this domain was flagged by 4 of 95 VirusTotal security vendors, indicating a moderate detection rate among antivirus engines. It was registered through 耐思尼克国际集团有限公司, a Chinese registrar often associated with suspicious domains, and was created on May 15, 2026. The domain resolves to IP address 172.67.130.145, which is part of Cloudflare's network, and uses a Let's Encrypt SSL certificate (E7). AlienVault OTX recorded this domain in 1 threat intelligence pulse, and it appears on 1 security blocklist, suggesting limited but confirmed malicious activity.

As the domain is currently offline, it poses no immediate threat, but users should remain vigilant as similar domains may appear. PhishDestroy recommends that cryptocurrency users avoid interacting with any unsolicited links or requests to connect wallets, especially those mimicking darknet marketplaces or crypto services. Always verify domain authenticity through official channels and use hardware wallets or browser extensions that detect phishing attempts. If you have connected your wallet to this domain, immediately revoke token approvals and transfer funds to a secure wallet.