cadween[.]net

Domain cadween.net has been identified as a crypto drainer impersonating a brand login interface, as indicated by its active distribution and infrastructure alignment with common cryptocurrency scam tactics. The site employs a generic phishing approach designed to trick users into connecting their cryptocurrency wallets or submitting login credentials under false pretenses, likely leveraging spoofed branding to enhance credibility. No specific drainer kit fingerprint has been publicly confirmed, but the operational pattern aligns with known crypto-draining operations that harvest private keys or seed phrases under the guise of authentication.

This domain exhibits several suspicious technical indicators: it shows 0 detections out of 95 on VirusTotal, indicating a lack of coverage by major antivirus engines. It was registered on May 12, 2026 through Cloudflare, Inc., and resolves to IP address 188.114.96.3. The domain secured a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. As of the latest assessment, it remains unblocked by Google Safe Browsing (GSB) and has not been listed on major threat intelligence blocklists, suggesting it is still in early deployment or evasion mode.

The domain is currently flagged as active and under investigation, with an initial risk level designated as 'under_investigation'. Despite zero detections, the combination of recent registration date, hosting provider, SSL certificate, and IP association raises immediate concern. PhishDestroy recommends immediate network and endpoint blocking of cadween.net and its associated IP. Users are advised to avoid interacting with the domain and to verify any suspicious login or wallet connection requests using PhishDestroy's real-time verification tools. While the current risk remains under evaluation, the absence of detections and active status warrant heightened caution to prevent potential cryptocurrency theft.