kvadden[.]cfd

Analysis indicates the domain kvadden.cfd was active as a cryptocurrency pre-sale phishing site, operational from its registration on February 21, 2026, until being taken offline by July 23, 2026. The page title, 'Kvadden Official Pre-Sale - Get Up to 200% Bonus!', explicitly signals an attempt to lure victims with unrealistic financial incentives, a common tactic in fraudulent token sales or investment scams. Infrastructure analysis reveals the domain was hosted behind Cloudflare (AS13335), resolving to IP 188.114.96.3, and using Cloudflare nameservers josephine.ns.cloudflare.com and toby.ns.cloudflare.com. The registrar, NiceNIC International Group Co., Limited, has been associated with other malicious domains but is not inherently high-risk.

No SSL certificate was present, increasing the likelihood of interception or further malicious redirection. Detection data shows the domain was flagged by 6 of 93 security vendors on VirusTotal and appears on one blocklist (PhishDestroy). The absence of additional blocklist entries or public threat intelligence (e.g., Safe Browsing, OTX) suggests limited visibility or recent takedown efforts. Defenders should treat this domain as confirmed malicious for the period it was active, particularly in contexts involving cryptocurrency or investment-related phishing.

Historical logs should be reviewed for connections to 188.114.96.3 or the domain itself, with particular attention to user reports of financial loss or credential exposure. The lack of SSL and reliance on Cloudflare infrastructure may aid in identifying related campaigns, though no direct links to known phishing kits or brands beyond the page title are confirmed. Further investigation into the registrar's other domains may reveal additional threats.