saturncredit[.]cam

The domain saturncredit.cam was registered on May 25 2026 and is currently classified as a high‑risk generic phishing site. Analysis indicates that the domain is being used to mimic a legitimate financial service, likely targeting users seeking credit information. Its activity is flagged as active as of the report date, July 12 2026.

Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is owned by CloudFlare, Inc. and geolocated to Canada. The domain is registered through Dynadot LLC, a registrar that frequently hosts short‑lived malicious sites. An SSL certificate issued by Let’s Encrypt (E8) is present, providing encrypted transport but offering no authentication of the underlying service.

Observational data places saturncredit.cam on a single security blocklist and confirms that it is blocked by the PhishDestroy feed. The web server returns an HTTP 502 status code, suggesting a misconfigured or intentionally disrupted backend. VirusTotal scans report that five of ninety‑five security vendors have flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment.

Defenders should add saturncredit.cam to network deny lists and configure DNS filtering to prevent resolution. Continuous monitoring of the associated IP 188.114.97.3 is advised, as the address may be reused for additional campaigns. Given the low trust score and active blocklist status, proactive sinkholing or traffic redirection can mitigate user exposure while investigative teams gather further intelligence.