kwadin[.]net

The domain kwadin.net is identified as a crypto drainer scam targeting cryptocurrency investors through a fraudulent token presale offering. Analysis of the page title, "Kwadin Official Presale including up to 200% bonus," indicates an attempt to lure victims with unrealistic financial incentives. The domain is currently offline, though prior infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.97.3 and employed Cloudflare for hosting and protection. Security vendors flagged the domain as malicious, with 11 of 95 VirusTotal vendors detecting it as a threat. Additionally, it appears on two security blocklists and holds a Gridinsoft trust score of 0/100. The SSL certificate was issued by Google Trust Services, and the site utilized technologies including Node.js, Bootstrap, Socket.io, jQuery, HSTS, and HTTP/3. While kwadin.net is currently offline, the domain remains a documented threat vector. Organizations and individuals are advised to block the domain and its associated IP at the network level. End users should be educated on recognizing crypto drainer scams, particularly those leveraging unrealistic bonus offers or presale claims. Security teams are recommended to monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure.