kardehn[.]com

On July 24, 2026 analysts observed that the domain kardehn.com is hosting a page titled “Kardehn Token | Official Website – Secure Presale & High Bonus Rewards”. The site lacks an SSL certificate, indicating it is served over plain HTTP. Registration data show the domain was created on February 27, 2026 through Hostinger Operations, UAB, and is hosted on IP 84.32.84.157, which belongs to AS47583 Hostinger International Limited located in Lithuania. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com. VirusTotal scans returned a detection ratio of 2 out of 94 security vendors, confirming that at least two independent scanners have identified malicious characteristics.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reflecting community‑based detection of brand‑impersonation activity. The current operational status is offline, and the risk level has been assigned as elevated. Analysis indicates that the domain is being used for a brand‑impersonation phishing campaign targeting users interested in cryptocurrency token sales, as inferred from the page title. The absence of TLS, recent registration date, and hosting on generic parking name‑servers are consistent with throwaway phishing infrastructure.

However, no additional artifacts such as phishing email samples, credential‑harvesting forms, or redirects have been disclosed, leaving the full attack vector uncertain. Defenders should add kardehn.com to URL filtering and endpoint allow‑list exclusions, monitor inbound DNS queries for the associated IP range, and consider sharing the indicator with threat‑intel platforms. Continuous re‑scanning on VirusTotal or similar sandboxes is advised to capture any changes in payload or detection status. Because the site is already offline, immediate blocking will mitigate potential user exposure while further investigation proceeds.