caddun[.]io

PhishDestroy identifies caddun.io as an active AI-powered invoice phishing domain under investigation for generic phishing tactics. The site masquerades as a legitimate invoicing portal to harvest corporate payment credentials and financial data. Threat actors leverage generative AI to craft convincing fake invoice templates and payment reminders, capitalizing on urgent supplier communication scenarios to lower user suspicion and bypass detection filters. This domain was flagged with key indicators including a VirusTotal detection score of 2/95, which indicates it remains unflagged by most antivirus engines despite suspicious behavior. The domain was registered through Cloudflare, Inc on April 14, 2026, and resolves to IP 172.67.201.129 using a Let's Encrypt SSL certificate. This combination of recent registration, privacy shielding via Cloudflare, and clean VirusTotal status suggests a newly deployed, carefully configured fraudulent infrastructure designed for short operational lifespans to avoid blocklisting. Users who visited caddun.io should immediately cease any interaction with the site, avoid entering credentials or financial data, and scan their devices for malware using updated antivirus tools. Report the domain to your IT security team or block it at the network level via DNS filtering. Monitor accounts for unauthorized transactions and enable MFA on all financial platforms. Given the domain's recent creation and low detection coverage, assume compromise and audit recent invoices, payment confirmations, and supplier communications for anomalies.