setksail[.]com

PhishDestroy identifies setksail.com as an active domain engaged in CEX brand impersonation phishing. The site masquerades as a legitimate CEX exchange to deceive users into surrendering credentials or sending cryptocurrency to attacker-controlled wallets. Current status remains under investigation but exhibits indicators consistent with crypto drainer campaigns targeting exchange users.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating it has evaded automated detection systems despite its deceptive design. The domain was registered through Dynadot Inc on April 18, 2026, and resolves to IP address 104.21.7.151. The SSL certificate issued by Let’s Encrypt may further lend false legitimacy to the site. Additional red flags include the domain’s recent creation date paired with a lack of established reputation metrics, suggesting it was registered specifically for this campaign. Historical blocklist records show no prior associations, reinforcing the likelihood of a targeted, short-lived operation.

PhishDestroy recommends blocking access to setksail.com at the network level and disabling any links or references to the domain in organizational systems. Users should verify the authenticity of any CEX-related communications by cross-referencing official domains and enabling two-factor authentication on exchange accounts. If exposure has occurred, immediately rotate passwords, revoke API keys, and monitor wallet addresses for unauthorized transactions. Security teams should update firewall and DNS blocklists to include this domain and its hosting IP. Report the domain to abuse channels and consider filing a complaint with CEX support to aid in takedown efforts.