kadven[.]io

Analysis indicates that the domain kadven.io is an active phishing infrastructure impersonating Binance, specifically targeting users with a fraudulent token presale offering. Registered on December 25, 2025, through NiceNIC International Group Co., Limited, the domain currently resolves to 188.114.97.3, an IP address hosted on Cloudflare's network (AS13335) in the United States. The site returns an HTTP 301 redirect status, a common technique used to obscure the final malicious destination or to evade detection during automated scans. The domain is configured with Cloudflare nameservers (anna.ns.cloudflare.com and dakota.ns.cloudflare.com) and employs HTTP/3, leveraging Cloudflare's infrastructure to enhance performance and resilience. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not validate the site's content or intent. The page title, 'Kadven Official Presale including up to 200% bonus,' explicitly references a token presale, a known scam tactic in cryptocurrency-related fraud. This aligns with the identified phishing kit labeled 'Token Presale,' further confirming its fraudulent purpose. Security vendors have begun flagging kadven.io, with three out of 93 engines on VirusTotal detecting it as malicious. The domain is also blocked by PhishDestroy and appears on at least one other security blocklist. Despite these detections, the infrastructure remains active as of July 12, 2026. Defenders should treat this domain as high-risk and prioritize blocking or monitoring any connections to it. Given the use of Cloudflare and the domain's recent registration, takedown efforts may face delays, and the threat actor could quickly pivot to alternative domains. No additional details about the phishing kit's functionality or the final payload are available at this time, but the combination of a presale lure and Binance impersonation suggests a focus on stealing cryptocurrency or credentials from unsuspecting users.