sag20nds[.]top

This domain is flagged as a high-risk crypto drainer, specifically designed to impersonate the VOLTX-EX platform. Analysis indicates the threat type involves credential theft and unauthorized transaction redirection, targeting users of cryptocurrency wallets and exchanges. The domain exhibits characteristics consistent with malicious infrastructure used to drain funds from victims' wallets upon interaction. Infrastructure analysis reveals the following technical indicators: the domain sag20nds.top was registered on May 14, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial platforms. It resolves to IP address 104.21.43.78, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged by threat actors to obfuscate origins. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. The domain appears on 3 security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports 3 out of 95 security vendors flagging this domain as malicious, a low but notable detection rate that suggests targeted or emerging threats. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (104.21.43.78) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent user access. Users should be educated on recognizing crypto drainer tactics, such as unsolicited prompts for wallet connections or seed phrase requests. Wallet software should be configured to reject connections to untrusted domains, and transaction signing should require explicit user confirmation. Given the domain's active status and impersonation of a known platform, monitoring for similar domains registered through Gname.com Pte. Ltd. or resolving to Cloudflare IPs is recommended for proactive threat hunting.