sdktek[.]sbs

This domain, sdktek.sbs, is identified as a crypto drainer phishing infrastructure designed to harvest cryptocurrency wallet credentials and execute unauthorized transactions. Analysis indicates no explicit brand impersonation, but the site employs generic phishing tactics common to drainer kits, likely targeting users through deceptive prompts or fake wallet interfaces. The absence of an SSL certificate and the use of a Cloudflare IP suggest attempts to obscure hosting origins while maintaining low operational costs. Infrastructure analysis reveals the following technical indicators: the domain resolves to 172.67.185.244 (AS13335, Cloudflare, Inc.), registered through NiceNIC International Group Co., Limited on November 05, 2025. VirusTotal detections stand at 19/95 security vendors, while the domain appears on one security blocklist and is currently flagged by PhishDestroy. The page title, "sdktek.sbs | 520: Web server is returning an unknown error," suggests either misconfiguration or deliberate obfuscation of malicious content. No SSL certificate is present, further reducing legitimacy signals. The domain has been taken offline, likely due to detection by security mechanisms or hosting enforcement actions. However, residual risk persists as the infrastructure may be reactivated under a new domain or IP. Users are advised to verify wallet addresses independently, avoid interacting with unsolicited prompts, and monitor transaction histories for unauthorized activity. Network administrators should block the domain and associated IP at the perimeter to prevent potential access from internal systems.