ranking-dexscreener[.]com

PhishDestroy identifies ranking-dexscreener.com as an active crypto drainer phishing domain currently under investigation. The domain is designed to impersonate DexScreener, a legitimate cryptocurrency analytics platform, with the goal of deceiving users into connecting crypto wallets and draining assets under false pretense. This threat is categorized as a crypto drainer phishing attempt due to its active redirection toward malicious smart contract interactions and wallet-connect prompts. The investigation status remains active as analysts assess the full scope of its operational infrastructure and potential victim impact. This domain was flagged by MetaMask and SEAL, two reputable security platforms focused on cryptocurrency threat prevention. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolved to IP address 172.67.142.232. Security blocklist records indicate it has been listed on 2 independent threat intelligence feeds. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, which may assist in evading user-level detection. Notably, it remains undetected by VirusTotal scanning infrastructure, with 3 of 95 security vendors currently flagging the domain as malicious—highlighting the evolving nature of such crypto-draining threats and the sophistication in evasion techniques employed. Organizations and crypto users are strongly advised to block access to ranking-dexscreener.com at the network and endpoint levels immediately. Blocking rules should include URL filtering, DNS sinkholing, and firewall rules targeting the resolved IP (172.67.142.232). Users should verify the authenticity of any "DexScreener" or ranking-related links, especially those shared in chat groups or social media. Implement wallet-connect permission monitoring tools and utilize hardware wallet solutions for high-value transactions to mitigate drainer risks. Security teams are encouraged to monitor for similar domains using the seed identifier 486868 and to contribute telemetry to threat intelligence platforms to improve collective defense against crypto drainer campaigns.