saturn-credit[.]com

This domain, saturn-credit.com, operates as a crypto drainer phishing site designed to deceive users into connecting digital wallets under the guise of offering "Digital Dollars on Digital Credit." The site employs social engineering tactics to trick victims into authorizing malicious transactions, which then drain cryptocurrency assets from connected wallets without consent. Analysis of the page title and infrastructure suggests a focus on targeting users seeking credit or lending services in the cryptocurrency space, a common vector for financial scams. Evidence indicates this domain poses a credible threat. VirusTotal reports 8 out of 95 security vendors flagging saturn-credit.com as malicious. The domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently appears on four security blocklists, including MetaMask and ScamSniffer, which specialize in cryptocurrency-related threats. The domain resolves to IP address 104.21.67.129 and utilizes Cloudflare for hosting and DDoS protection, a common tactic to obscure malicious infrastructure. Technologies detected include Framer Sites, React, and HTTP/3, suggesting a modern, interactive frontend designed to mimic legitimate financial platforms. Users who visited saturn-credit.com should assume their wallet credentials or transaction authorizations may have been compromised. Immediately disconnect any linked wallets from the site and revoke any suspicious smart contract approvals using a wallet management tool. Monitor connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet if any interaction with the domain occurred. Enable hardware wallet or multi-signature protections for future transactions. Given the domain's elevated risk level and offline status, remain vigilant for similar phishing attempts using comparable branding or credit-related lures.