kvadden[.]sbs

On July 23, 2026, analysis was performed on the domain kvadden.sbs, which is classified as a generic phishing site with an elevated risk rating. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on a Cloudflare infrastructure (AS13335) located in the United States, resolving to IP address 188.114.96.3. The site lacked an SSL certificate, indicating it was served over plain HTTP. The page title retrieved during the brief observation, "Kvadden Official Pre-Sale - Earn Up to 200% Bonus!", suggests a financial‑incentive lure aimed at enticing victims with exaggerated returns.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. A VirusTotal scan recorded ten of ninety‑five security vendors flagging the domain as malicious, reinforcing the suspicion of malicious intent. Nameservers for the domain are josephine.ns.cloudflare.com and toby.ns.cloudflare.com. Current status is offline, and no additional content or payload details are available for further forensic examination.

Uncertainty remains regarding the exact phishing payload, credential‑capture mechanisms, or any associated command‑and‑control infrastructure because the site is no longer reachable. Defenders should proactively block kvadden.sbs at DNS and proxy layers, add the domain to internal blocklists, and monitor for any re‑registration or activity from the same IP address or Cloudflare name‑servers. Continuous threat‑intel feeds should be consulted for any emerging indicators linked to the IP 188.114.96.3 or the registrar NiceNIC, and detection rules should be updated to incorporate the observed page title and the ten vendor detections reported by VirusTotal.