sadcoinsol[.]xyz

Sadcoinsol.xyz is currently listed as an active high‑risk generic phishing infrastructure targeting cryptocurrency users. The site was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and immediately began serving content protected by Cloudflare's edge network, leveraging HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint despite malicious intent. Technical resolution points the domain to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are leo.ns.cloudflare.com and phoenix.ns.cloudflare.com, confirming that the domain’s DNS is fully managed by the Cloudflare platform. This infrastructure choice provides rapid content delivery and hides the origin server, complicating attribution. Threat intelligence sources have flagged the domain across multiple platforms. VirusTotal reports four out of ninety‑five scanners flagging the host as malicious, while Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy feed. AlienVault OTX references the domain in one pulse, and the HTTP response code observed is 403, accompanied by the page title “Just a moment…”. These indicators collectively corroborate its classification as a crypto‑focused phishing operation. Defenders should prioritize immediate sink‑hole or firewall rules that deny outbound connections to 188.114.96.3 and to the domain sadcoinsol.xyz. Monitoring for DNS queries to the associated Cloudflare name servers can provide early warning of replication attempts. Given the low trust score and multi‑vendor detections, inclusion of the domain in endpoint and email security blocklists is advised. Continuous re‑evaluation is recommended, as the underlying IP may be reused for additional malicious campaigns.