com-c[.]sbs

This domain, com-c.sbs, is identified as a crypto drainer phishing operation targeting users through deceptive links designed to empty cryptocurrency wallets. As of the latest assessment, the domain has been taken offline, though prior activity indicates malicious intent. The infrastructure was previously hosted on Cloudflare’s network, with no legitimate content observed during active periods. Analysis indicates the domain was flagged by 9 of 95 security vendors on VirusTotal, a notably high detection rate for phishing-related threats. Registered through Global Domain Group LLC on February 21, 2026, the domain resolves to the IP address 188.114.96.3, associated with Cloudflare’s autonomous system (AS13335). The domain appears on three security blocklists, including entries from specialized phishing and cryptocurrency threat intelligence sources. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain’s malicious classification, as phishing operations frequently leverage legitimate certificate authorities to appear trustworthy. The current offline status suggests temporary deactivation, though historical patterns indicate potential reactivation under altered infrastructure. Organizations and individuals are advised to block the domain at the DNS level and monitor for re-emergence on new IP addresses or subdomains. End-users should verify cryptocurrency transaction links through official wallet interfaces and avoid interacting with unsolicited URLs, particularly those distributed via messaging platforms or social media. Security teams should treat any future resolution of this domain as high-risk and conduct retrospective log analysis to identify prior exposure.