craddon[.]icu

This domain is flagged as an elevated-risk crypto drainer phishing site targeting users of the Craddon Token cryptocurrency project. Analysis indicates the infrastructure was designed to deceive victims into connecting wallets, enabling unauthorized transactions that permanently transfer digital assets to attacker-controlled addresses. The page title, 'Craddon Token,' directly mimics legitimate token projects, increasing the likelihood of successful social engineering against cryptocurrency holders seeking investment opportunities. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain craddon.icu was registered on November 27, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 188.114.97.3. Security vendors on VirusTotal flagged the domain, with 5 out of 95 detecting malicious activity. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one security blocklist, specifically PhishDestroy. Detected technologies include WordPress, MySQL, PHP, Raphael, Chart.js, YouTube embeds, Material Design Lite, and Slider Revolution, suggesting a sophisticated frontend designed to appear legitimate while concealing malicious backend functionality. Mitigation against crypto drainer threats requires heightened vigilance from both users and security teams. Cryptocurrency holders should verify token project legitimacy through official channels before connecting wallets to any website. Wallet software should enforce strict transaction confirmation prompts, and users must scrutinize every authorization request, particularly those granting unlimited spend permissions. Security teams should block the domain craddon.icu and its resolving IP 188.114.97.3 at the network perimeter. Monitoring for similar domains registered through NiceNIC or resolving to the same IP range may identify additional phishing infrastructure. Cryptocurrency exchanges and wallet providers should alert users attempting to interact with flagged domains and integrate blocklist updates to prevent asset loss.