cakewalletdesktop[.]live

The domain cakewalletdesktop.live is currently flagged as an active crypto drainer phishing site, specifically designed to impersonate the legitimate Cake Wallet cryptocurrency service. This infrastructure is engineered to deceive users into connecting their wallets, enabling unauthorized transactions that siphon digital assets without consent. Analysis indicates the domain remains operational and continues to pose a high-risk threat to unsuspecting victims. Infrastructure analysis reveals critical indicators of compromise. The domain was registered on November 21, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent activities. It resolves to the IP address 64.29.17.1, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendors have flagged this domain, with 13 out of 95 detections on VirusTotal, and it appears on three distinct security blocklists. Notably, the site lacks an SSL certificate, further reducing its legitimacy and increasing exposure to interception attacks. The page title, 'Cake Wallet - Privacy Made Easy,' is a direct mimicry of the authentic service, enhancing its deceptive appeal. Current status confirms the domain remains active and unmitigated, continuing to target users through phishing campaigns. Organizations and individuals are strongly advised to block this domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with this domain should immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Given the high-risk nature of crypto drainers, proactive measures such as browser-based wallet isolation and multi-factor authentication for sensitive operations are recommended to mitigate further exposure.