candycluster[.]cc

PhishDestroy identifies candycluster.cc as an active crypto drainer posing as a wallet connection page to steal cryptocurrency assets. The domain mimics legitimate wallet interfaces to trick users into authorizing malicious transactions upon connection. Security tools including MetaMask and SEAL have flagged this domain as malicious, while VirusTotal reports 5 out of 95 security vendors have marked it as unsafe. This domain was registered through NameCheap, Inc. on March 05, 2026, and has already been added to 3 active blocklists, indicating rapid identification as a threat. The domain resolves to IP 104.21.91.161 and uses a Let's Encrypt SSL certificate to appear legitimate. Despite its recent creation, candycluster.cc has been widely detected due to its clear intent: to deceive users into connecting their wallets under false pretenses. The use of a generic name like 'candycluster' is likely designed to evade early detection while capitalizing on user curiosity or urgency. The page title 'Connect Wallet' reinforces the deception, tricking users into believing they are accessing a standard wallet integration interface. Users who visited candycluster.cc should immediately disconnect any connected wallets, revoke any unauthorized permissions, and transfer remaining assets to a clean wallet. If transactions were authorized, contact your wallet provider and report the incident to relevant cryptocurrency fraud units. Verify unknown domains using PhishDestroy's threat intelligence database before interacting. Never connect your wallet to unverified sites, and always cross-check URLs against official sources.