threshold[.]sbs

PhishDestroy identifies threshold.sbs as an active crypto drainer domain designed to siphon cryptocurrency from unsuspecting victims. This threat relies on impersonating legitimate crypto platforms to trick users into connecting wallets and authorizing fraudulent transactions. As of this advisory, the domain remains live and poses an elevated risk to organizations handling digital assets. This domain was flagged by just 1 out of 95 VirusTotal security vendors, indicating limited but concerning detection coverage. Registration details reveal it was created on March 31, 2026, through Dynadot LLC, and resolves to IP address 185.53.179.128. Despite its recent registration, the minimal VirusTotal detections underscore the stealthy nature of crypto drainer operations, which often evade initial detection mechanisms. Organizations should block threshold.sbs at the network perimeter and update endpoint security solutions to flag associated IP addresses and domains. Users interacting with crypto platforms must verify URLs independently and avoid clicking unverified links. Security teams are advised to monitor for signs of wallet draining activity and report any suspicious transactions to relevant crypto platforms and law enforcement. Proactive threat hunting for similar domains and IoCs is strongly encouraged to mitigate potential financial losses.