sanctumreward[.]com

The domain sanctumreward.com was registered on July 21, 2025 via NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently taken offline. DNS resolution points to IP address 216.150.16.65, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. An SSL certificate labeled R11 is present, indicating that the site offered HTTPS connections before being disabled. The page title returned from the site, "sanctum-mirror-web," is consistent with a previously observed naming convention used by malicious actors.

The domain is listed on two security blocklists, PhishDestroy and ScamSniffer, and appears in multiple threat‑intelligence feeds as a brand‑impersonation campaign targeting the backpack brand. VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The Gridinsoft trust score for the domain is 0 out of 100, reflecting an extremely low reputation. The observed scam type is a crypto scam, suggesting that any payload or request associated with the site likely involved cryptocurrency‑related fraud.

While the offline status prevents immediate interaction, the infrastructure details remain relevant for defenders. Security teams should block the IP 216.150.16.65 and the domain sanctumreward.com at perimeter defenses, monitor for any resurgence of the host on other domains, and incorporate the page title and blocklist identifiers into their detection rules. Continuous review of related blocklists and VirusTotal submissions is advised to capture any future re‑hosting attempts.