setmsail[.]cc

PhishDestroy confirms setmsail.cc as an active crypto-drain phishing site that targets digital-asset users by luring them into connecting wallets or entering private keys. The domain originated on 18 April 2026 and resolves to IP address 188.114.97.3. Registrant data shows creation through DYNADOT LLC with a Let’s Encrypt SSL certificate in place. Only 1 of 95 VirusTotal engines currently detects the threat, indicating low initial visibility yet active operation.

Technical indicators align with generic phishing infrastructure: the domain is freshly registered, lacks a long-standing reputation, and returns a modest IP geolocation footprint. Low VirusTotal coverage (1/95 detections on the day of analysis) suggests evasion tactics such as fast-flux hosting or minimal payload staging. The presence of a publicly trusted SSL certificate increases perceived legitimacy and lowers user caution, a common tactic leveraged by crypto-drainers to harvest wallet credentials or seed phrases.

Users must refrain from interacting with setmsail.cc or any linked pages requesting wallet connections or seed inputs. Verify any suspicious link by pasting the full URL into PhishDestroy before proceeding. Wallet owners should revoke any unintended permissions and rotate exposed keys in a secure, air-gapped environment. Report the domain immediately to your security provider and to PhishDestroy to accelerate global takedown efforts.