segredodacnh[.]sbs

PhishDestroy identifies segredodacnh.sbs as an active crypto drainer phishing domain currently under investigation for fraudulent cryptocurrency harvesting activities. This domain is designed to deceive users into connecting crypto wallets or entering seed phrases, risking direct asset theft. This domain resolves to IP 104.21.2.163 and was registered on April 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. As of the latest scan, it remains undetected by VirusTotal, with 0 security vendors flagging it out of 95, indicating a low initial detection rate. The domain holds a valid Let’s Encrypt SSL certificate, which may enhance its perceived legitimacy among unsuspecting users. While no public blocklist entries were detected during initial analysis, the absence of detections suggests a rapidly evolving or highly targeted campaign. Given its active status and lack of security vendor coverage, PhishDestroy advises immediate caution. Users should avoid interacting with segredodacnh.sbs or any associated links. Employ multi-layered verification, such as cross-referencing URLs with PhishDestroy’s threat intelligence database or using hardware wallet approvals for all crypto transactions. Organizations are encouraged to update firewall rules to block the associated IP (104.21.2.163) and monitor DNS queries for this domain. Continuous monitoring is recommended due to the dynamic nature of phishing campaigns and low initial detection rates.