sandscreener[.]io

The domain sandscreener.io was observed on July 22 2026 as part of a brand‑impersonation campaign targeting Discord users. VirusTotal records show that one out of ninety‑five scanning engines flagged the host, indicating at least a single detection. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single public security blocklist. PhishDestroy has also listed the site as blocked, reinforcing the view that it is being used for malicious purposes. The domain resolves to 185.199.110.153, an address owned by Fastly, Inc. (AS54113) located in the United States.

Nameserver delegation points to dns1.registrar‑servers.com and dns2.registrar‑servers.com, consistent with registration through NameCheap, Inc. The TLS certificate is issued by Let’s Encrypt (R13), providing valid HTTPS encryption but offering no guarantee of legitimacy. Infrastructure fingerprints reveal the use of Varnish caching, Bootstrap front‑end framework, GitHub Pages hosting, Font Awesome icons, Fastly CDN services, and Prism syntax highlighting. The page title returned by the server is “Sandscreener – A Proof of Innocence tool for Tornado Cash users,” which does not reference Discord but suggests a cryptocurrency‑related narrative. Nevertheless, the intelligence file tags the site as impersonating Discord, indicating that the attacker may be leveraging the Tornado Cash theme to lure Discord community members. MX records list eforward3.registrar‑servers.com with priority 10; a second MX entry is truncated in the source data, leaving the full mail routing configuration uncertain.

Because the site is currently offline, active payloads cannot be inspected, and the exact phishing content remains unknown. Defenders should continue to block the domain at network and email gateways, monitor the associated IP address for any re‑activation, and add the host to internal threat‑intel feeds.