sage-union[.]ai-cryptolist[.]net

This domain posed as a cryptocurrency-related service to trick visitors into connecting their wallets, enabling automatic draining of funds. The site's deceptive 'Just a moment...' page was likely a front for credential harvesting or wallet connection prompts. Such crypto drainers are particularly dangerous as they can empty a wallet in seconds without the user realizing until it's too late.

The threat was identified through multiple security sources. VirusTotal flagged it with 2 out of 95 vendors detecting malicious activity, and it appears on one security blocklist. The domain was registered through Key-Systems GmbH on April 11, 2026, and resolved to IP address 172.67.198.248 with an SSL certificate from Google Trust Services. Although the site is now offline, its brief active period could have compromised many users.

If you visited this site and connected your cryptocurrency wallet, immediately transfer all funds to a new, secure wallet. Revoke any permissions granted to the domain through blockchain explorers or wallet settings. Monitor your accounts for unauthorized transactions and consider using hardware wallets for enhanced security. For any suspected compromise, change passwords and enable two-factor authentication on associated accounts.