sachicoin[.]net

This domain, sachicoin.net, is identified as a cryptocurrency credential theft operation targeting users through deceptive wallet interfaces. Analysis indicates no direct brand impersonation, but the domain mimics legitimate crypto services to harvest private keys, seed phrases, or wallet credentials. The page title 'Nur einen Moment…' suggests a German-language audience or a localized phishing template, though no specific cryptocurrency project or exchange is directly spoofed in the available data. Infrastructure analysis reveals the domain was registered on November 4, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.49.81, a Cloudflare proxy endpoint commonly used to obscure hosting origins. At the time of assessment, VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. Gridinsoft assigns a trust score of 0 out of 100, further corroborating its malicious classification. As of the latest verification, sachicoin.net has been taken offline, likely due to hosting provider or registrar enforcement actions. However, the underlying infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users who interacted with the site prior to takedown should immediately revoke wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Security teams are advised to add the domain and associated IP to blocklists, and to conduct retroactive scans for any prior exposure within their networks.