p2-sachicoin[.]com

Analysis of p2-sachicoin.com indicates that the domain was registered on 22 November 2025 through NiceNIC International Group Co., Limited and points to the Cloudflare address 172.67.179.67, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The domain resolves to a Cloudflare edge node and does not present an SSL certificate, causing browsers to display a generic “Just a moment…” title when accessed. No HTTP payload was captured because the site was taken offline prior to examination, and the page title remains the only visible artifact. VirusTotal scans reported that two of ninety‑five antivirus or URL‑reputation engines flagged the domain, and the site is listed on at least one public phishing blocklist, PhishDestroy.

Independent reputation services assign a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. The lack of TLS, the low trust score, and the presence on a dedicated phishing blocklist collectively suggest a phishing or credential‑harvesting campaign, although the specific brand or victim profile cannot be confirmed from the available data. Uncertainty remains regarding the exact payload, the lure employed, and any additional infrastructure that may have been used before the takedown.

Defenders should immediately block DNS resolution for p2-sachicoin.com and the associated IP address, add the domain to URL filtering rules, and monitor outbound traffic for connections to Cloudflare edge nodes that share the same ASN. Continuous observation of new registrations that resolve to the same IP range is advised, as adversaries frequently reuse Cloudflare infrastructure for fast‑flux style deployments. Incident response teams should also query threat‑intel feeds for any emerging indicators that reference the domain or its IP, and consider sharing the observed indicators with industry blocklists to improve collective defenses.