cannine[.]sbs

This domain, cannine.sbs, is identified as a high-risk phishing resource targeting cryptocurrency wallet users under the guise of an "AML Checker - Wallet" service. Analysis indicates the site employs credential harvesting and asset drainage techniques, likely leveraging a cryptocurrency drainer kit to exfiltrate private keys or seed phrases. The page title and functionality suggest an attempt to mimic legitimate anti-money laundering verification tools, a common tactic to exploit users concerned with compliance or security. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious registrations. It resolves to the IP address 172.67.175.68, a Cloudflare-protected endpoint, which obscures the origin server and complicates takedown efforts. Detection metrics show 10 out of 95 security vendors on a prominent threat intelligence platform flag the domain as malicious. Additionally, the domain appears on three distinct security blocklists, including those maintained by browser security extensions and cryptocurrency-specific threat feeds. The SSL certificate, issued by Let’s Encrypt, provides basic encryption but does not mitigate the underlying malicious intent. A trust score of 0/100 from an independent threat assessment platform further corroborates the domain’s fraudulent nature. As of the latest assessment, cannine.sbs has been taken offline, likely following coordinated takedown actions by security entities and hosting providers. Despite its current inactive status, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the domain prior to its deactivation may remain vulnerable to follow-up attacks, including targeted phishing or malware distribution. It is recommended to revoke any permissions granted to the domain, rotate cryptocurrency wallet credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise to prevent future exposure.