carpedao[.]org

Analysis of the domain carpedao.org indicates it was established as a phishing infrastructure targeting users through an airdrop scam. The domain was registered on March 04, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Nameservers lynn.ns.cloudflare.com and walk.ns.cloudflare.com were assigned, consistent with Cloudflare’s DNS configuration. No SSL certificate was detected at the time of assessment. The domain has been flagged by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists.

VirusTotal reports that 3 of 94 security vendors classify this domain as malicious, though this does not represent a comprehensive detection rate. The page title returned a 404 Not Found error, suggesting the site may have been taken down or reconfigured prior to analysis. The exact content of the phishing kit is not fully documented, but available intelligence categorizes it as an airdrop scam, a common tactic used to deceive users into disclosing wallet credentials or transferring cryptocurrency. Defenders should treat carpedao.org as a confirmed malicious domain.

Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or decentralized finance (DeFi) platforms. Given its association with Cloudflare infrastructure, monitoring for newly registered domains under the same nameservers or IP range may help identify related threats. The domain’s current offline status does not preclude future reactivation; continuous monitoring of blocklists and detection feeds is advised. No additional brand impersonation or specific target details were confirmed in the available data.