sadcoincap[.]xyz

Analysis indicates that sadcoincap.xyz is a high-risk domain currently flagged as a generic phishing site targeting cryptocurrency users. Registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is actively proxied by Cloudflare, as evidenced by its nameservers (leo.ns.cloudflare.com and phoenix.ns.cloudflare.com) and the detection of Cloudflare Browser Insights and HTTP/3 technologies. At the time of assessment, the domain returns an HTTP 403 status, suggesting access restrictions or a placeholder page with the title 'Just a moment...', a common Cloudflare interstitial response. Security vendor detections are limited but notable: four of ninety-five engines on VirusTotal classify the domain as malicious. Additionally, it appears on one security blocklist and has been included in a single AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with modern phishing infrastructure leveraging legitimate certificate authorities. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its classification as high-risk. While the exact content and phishing mechanics of sadcoincap.xyz remain unconfirmed due to restricted access, the domain name suggests a focus on cryptocurrency-related deception, potentially mimicking legitimate coin tracking or wallet services. Defenders should treat this domain as active and malicious, blocking resolution at the DNS or network level. Monitoring for changes in HTTP status or page content is recommended, as the site may transition from a restricted state to an operational phishing page. No specific brand impersonation or scam subtype has been confirmed beyond the generic phishing classification.