sachicoin[.]live

This domain, sachicoin.live, is actively flagged as a high-risk phishing site impersonating the Solana blockchain platform. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:3031::6815:412e, leveraging Cloudflare’s infrastructure and HTTP/3 protocol. The page title, 'Sachi Coin – Cutest Force on Solana,' explicitly references Solana, aligning with the brand impersonation threat type. The domain appears in 23 threat intelligence pulses on AlienVault OTX, and three security blocklists, including ScamSniffer and PhishDestroy, have already classified it as malicious. A Gridinsoft trust score of 0/100 further corroborates its high-risk status. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate, which, while providing encryption, does not mitigate the domain’s malicious intent. The domain remains active as of July 12, 2026, with no indications of takedown or remediation efforts. Security vendors on VirusTotal have flagged the domain, with 3 out of 95 detecting it as malicious. While this detection rate is relatively low, it does not diminish the domain’s confirmed presence on multiple blocklists and threat intelligence platforms. The exact nature of the phishing campaign remains unclear due to limited visibility into the site’s content or backend mechanisms. However, the combination of brand impersonation, Cloudflare-hosted infrastructure, and active blocklist inclusion strongly suggests a targeted effort to deceive users into engaging with fraudulent Solana-related content. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related indicators of compromise, such as the resolving IPv6 address or associated SSL certificate. Given its continued activity, organizations should also assess whether internal systems or users have interacted with the domain and take appropriate remediation steps if necessary.