cryptokhadija[.]sbs

The domain cryptokhadija.sbs has been identified as a confirmed phishing site, categorized under the threat type of generic_phishing. There is no specific brand or drainer kit associated with this domain, indicating a broader attempt to target a wide range of users rather than a specific organization or service.

Analysis indicates that the domain has been flagged by 5 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection but also highlighting the potential for wider distribution and impact. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.72.210. It was created on June 24, 2026, and uses an SSL certificate issued by Google Trust Services, which may lend it an appearance of legitimacy and enhance its ability to deceive users. The domain's status in Google Safe Browsing (GSB) is not explicitly mentioned, but the elevated risk level and active status suggest it may be flagged or under scrutiny.

The domain cryptokhadija.sbs is currently active and poses an elevated risk to users. Response actions should include blocking the domain at network and endpoint levels, educating users about the signs of phishing, and monitoring for any related infrastructure. Despite the current detection rate, the remaining risk is high, as the domain's use of a reputable SSL certificate and active status indicate ongoing phishing activities.