sageswap[.]cc

This domain, sageswap.cc, is flagged as a high-risk phishing site targeting decentralized exchange (DEX) users under the guise of SageSwap. Registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 185.111.111.158, hosted by DataCamp Limited in Germany. Infrastructure analysis reveals the use of nameservers coco.bunny.net and kiki.bunny.net, alongside a Let's Encrypt SSL certificate issued under the R12 intermediate. The domain currently returns an HTTP 301 redirect, a common technique to obscure the final destination or evade detection. Security vendor assessments indicate a consistent malicious classification, with 10 out of 95 engines on VirusTotal flagging the domain as phishing-related. The page title, SageSwap, directly mimics the legitimate platform, suggesting an intent to deceive users into interacting with fraudulent smart contracts or wallet-draining schemes. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a DEX scam. Defenders should treat this domain as an active threat. The combination of a recent registration, low trust scores, and direct impersonation of a known DEX brand aligns with typical phishing infrastructure. Network-level blocking of 185.111.111.158 and associated nameservers is recommended, along with monitoring for related SSL certificates or subdomains. While the exact payload remains unconfirmed, the domain's behavior and infrastructure are consistent with credential harvesting or wallet compromise attempts. No legitimate use case has been identified for this domain.