trade[.]oakwell-cl[.]net

The domain oakwell-cl.net was identified as a crypto drainer phishing site, specifically designed to steal cryptocurrency by impersonating the Oakwell C.L brand. This threat type involves tricking users into connecting their crypto wallets or revealing private keys, leading to asset theft. The domain has been taken offline, but its short lifespan and recent creation on March 12, 2026, indicate a targeted attack. Although now inactive, similar domains may reappear under different names.

Technical analysis reveals that oakwell-cl.net was flagged by 1 of 95 VirusTotal vendors, and it appears on 3 security blocklists. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 104.21.48.245, which is associated with Cloudflare. The site used an SSL certificate from Google Trust Services / WE1, which is common among legitimate sites but does not guarantee safety. The low flag count suggests the domain was rapidly deployed and detected late, a common tactic in phishing campaigns.

As the domain is now offline, users who previously visited it should scan their devices for malware, revoke any permissions granted to the site, and monitor their crypto wallets for unauthorized transactions. To avoid future threats, always verify URLs carefully, avoid clicking on unsolicited links, and use security tools that block known phishing domains. Report any suspicious crypto-related sites to security platforms to help protect others.