cladven[.]org

This domain is flagged as an active cryptocurrency presale phishing operation targeting users with fraudulent investment offers. The site, cladven.org, presents itself as an official token presale platform, advertising a "200% bonus" to lure victims into transferring funds. Analysis indicates the page is designed to mimic legitimate cryptocurrency projects, exploiting urgency and high-return promises to bypass user skepticism. The threat specifically involves credential harvesting and direct cryptocurrency theft, with victims likely redirected to malicious wallets or tricked into sending funds to attacker-controlled addresses. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to IP address 172.67.148.229, a Cloudflare-protected endpoint that obscures the true hosting origin. Security vendor detections on VirusTotal stand at 14 out of 95, with at least one security blocklist already listing the domain. The site employs Let's Encrypt SSL certificates and runs on Node.js with Bootstrap, jQuery, and Socket.io, a common stack for dynamic phishing pages. The presence of HSTS and Cloudflare Browser Insights further suggests an attempt to appear legitimate while evading detection. Users who visited cladven.org or interacted with its content should immediately cease all engagement and revoke any connected wallet permissions. Any funds transferred to addresses provided by the site should be considered compromised, as recovery is unlikely. Affected users are advised to scan their devices for malware, particularly browser-based stealers that may have captured session cookies or credentials. Wallet addresses used on the site should not be reused, and all associated passwords or private keys must be rotated. Monitoring for unauthorized transactions on linked wallets or exchanges is critical, as attackers may attempt follow-up exploitation using harvested data.