sagrolimited[.]ltd

Analysis indicates that the domain sagrolimited.ltd was registered on February 21 2026 and is currently active. The authoritative name servers are nadia.ns.cloudflare.com and jose.ns.cloudflare.com, pointing to a Cloudflare front‑end with IP address 172.67.153.94, which belongs to AS13335 Cloudflare, Inc. located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming that the site uses a legitimate certificate chain but does not mitigate the malicious intent. HTTP requests receive a 403 status code, and the page title returned is simply "sagrolimited", providing no additional context. The site leverages Cloudflare and HTTP/3 technologies, a common choice for threat actors to hide infrastructure.

Multiple defensive feeds have already flagged the domain. It appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that four of ninety‑three scanners have raised detections, reinforcing the suspicion. The Gridinsoft trust score of 0 out of 100 further indicates a lack of trustworthiness. The domain is categorized as a brand‑impersonation campaign targeting the brand "across", and the risk level is marked as high.

The registrar listed is Hosting Concepts B.V., operating under the Registrar.eu brand, which does not provide additional protective controls. The observable evidence confirms that sagrolimited.ltd is being used for brand impersonation. However, the exact payload, phishing landing page content, and victim interaction flow have not been disclosed in the available data, leaving the specific attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any outbound connections to the associated IP, and update intrusion detection signatures to include the observed TLS fingerprint and HTTP/3 usage.