sahmcoin[.]com

This domain, sahmcoin.com, is an active phishing infrastructure targeting cryptocurrency users. Registered on February 21, 2026, through DreamHost, LLC, the domain resolves to 62.171.132.232, hosted on AS51167 (Contabo GmbH) in France. The site returns an HTTP 200 status with the page title 'sahmcoin,' suggesting a focus on a cryptocurrency-themed scam. Infrastructure analysis reveals the use of nameservers ns1.adbrandagency.com and ns2.adbrandagency.com, a configuration often associated with low-reputation hosting providers. The domain's MX records point solely to itself, a common tactic to avoid external email filtering. Technologies detected on the site include D3, xCharts, Chart.js, Bootstrap, LiteSpeed, Unpkg, Swiper, and jQuery, which are frequently used to create visually convincing but fraudulent investment or wallet interfaces. The SSL certificate is issued by Let's Encrypt (R13), providing basic encryption without validating legitimacy. The domain appears on one security blocklist and is flagged by 7 of 93 vendors on VirusTotal, indicating moderate but not universal detection. AlienVault OTX lists it in one threat intelligence pulse, further corroborating its malicious classification. Defenders should treat this domain as high-risk. The combination of cryptocurrency branding, recent registration, and low-trust hosting infrastructure aligns with known phishing patterns. While the exact mechanics of the scam (e.g., fake wallet, investment fraud, or token drainer) are not confirmed, the presence of charting libraries suggests an attempt to mimic legitimate trading platforms. Network-level blocking is recommended, along with monitoring for related domains using the same nameservers or hosting provider. No legitimate business use is identified, and the domain's Gridinsoft trust score of 0/100 reinforces its malicious intent.