cademarket[.]sbs

PhishDestroy identifies cademarket.sbs as an active crypto drainer campaign targeting cryptocurrency users through a fake login page. The domain impersonates a legitimate marketplace to trick users into connecting their wallets, where a drainer kit silently transfers assets to attacker-controlled addresses. This is a high-risk threat designed to exploit trust in familiar brands and deceive users into authorizing unauthorized transactions.

This domain exhibits clear malicious indicators. It carries a VirusTotal detection score of 6/95 security vendors, indicating moderate but significant threat recognition. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 15, 2026, it resolves to IP 104.21.10.120 and holds a Let's Encrypt SSL certificate. It appears on 2 global security blocklists and is actively blocked by MetaMask and SEAL, confirming its operational status as a phishing resource. The domain is newly created, suggesting a rapidly deployed campaign likely leveraging urgency or limited-time offers to bypass traditional detection.

The domain remains active as of the latest intelligence, with active blocking in place by major security platforms. PhishDestroy continues to monitor and flag this domain due to its elevated risk profile and potential for further spread. Users are advised to avoid this domain entirely and verify any suspicious links using PhishDestroy’s real-time scanner. Despite current takedown efforts, the risk remains elevated due to the domain’s new registration and active infrastructure. Always validate URLs and use hardware wallets or transaction simulation tools before connecting to unknown platforms.