cdn[.]caan[.]edu

Analysis of the domain cdn.caan.edu reveals infrastructure consistent with an active phishing operation targeting academic credentials. The domain was registered on March 18, 2026, and remains unresolved to a nameserver, a configuration often observed in short-lived phishing campaigns. It currently resolves to the IP address 188.114.97.3, which has been associated with other malicious activity in recent months. Security vendor detections on VirusTotal indicate that 4 of 95 engines flag this domain as malicious, though the specific payload or deception method has not been fully analyzed. The domain appears on one security blocklist and is actively blocked by PhishDestroy, confirming its classification as a high-risk threat. Defenders should treat this domain as hostile infrastructure and implement blocking measures at the DNS and network layers. Due to the absence of nameserver resolution, monitoring for changes in DNS records may provide early warning of further malicious activity. The exact brand or institution being impersonated is not confirmed in available data, but the use of an academic-sounding subdomain suggests an attempt to deceive students or faculty. No additional details regarding the phishing kit or payload are available at this time.