saebux[.]com

PhishDestroy identifies saebux.com as an active crypto drainer phishing domain currently under investigation. This domain, registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, exhibits all hallmarks of a sophisticated crypto-scamming operation. The domain resolves to IP 188.114.97.3 and leverages a Let's Encrypt SSL certificate to appear legitimate. While no specific drainer kit has been publicly associated with this domain yet, its recent creation and suspicious infrastructure strongly suggest the deployment of crypto-stealing scripts targeting unsuspecting users.

This domain presents several critical technical indicators that warrant immediate attention. VirusTotal currently shows 11/95 detections, indicating it remains under the radar of most security vendors. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been previously linked to malicious domains, adding to the credibility concerns. The domain's IP address, 188.114.97.3, hosts multiple high-risk domains, and its creation date falls suspiciously close to the deployment timeline of recent crypto drainer campaigns. Google Safe Browsing (GSB) has not yet flagged this domain, and public blocklists show no entries as of this advisory.

As of this analysis, saebux.com remains active and poses a significant threat to cryptocurrency users. Immediate actions include blocking the domain at the network and DNS levels, flagging the associated IP address, and monitoring for any new detections on VirusTotal. Users should avoid interacting with this domain entirely, and organizations are advised to update firewall rules and endpoint protections to prevent access. While the exact risk level is still under investigation, the combination of low VT detections, suspicious infrastructure, and crypto drainer activity patterns suggests a high likelihood of malicious intent. Proactive blocking and user awareness campaigns are strongly recommended to mitigate potential financial losses.