satsume[.]live

PhishDestroy identifies satsume.live as an active crypto drainer posing as a trustworthy service to trick users into connecting cryptocurrency wallets. Once a victim grants access, the site silently drains tokens or NFTs from the connected wallet, often exploiting smart contract approvals granted during wallet connection. This is a clear example of a 'crypto drainer' scam, where the attacker does not need to hack the blockchain—only trick the user into authorizing transactions.

This domain was flagged by 1 out of 95 security vendors on VirusTotal, suggesting low detection but high risk for unprepared users. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and went live on March 28, 2026—making it a very recent threat. Despite using a Let's Encrypt SSL certificate to appear legitimate, the domain’s age and rapid setup are common tactics used by scammers to avoid detection.

If you visited satsume.live, do not connect any wallet or enter any credentials. Close the tab immediately and revoke any wallet connections made using tools like Etherscan’s Token Approval Checker or Revoke.cash. Scan your device with updated antivirus software and consider rotating wallet addresses used on suspicious sites. Never reuse passwords across platforms and enable multi-factor authentication where possible. Report the domain to your wallet provider and local cybersecurity authorities.