shadix[.]to

The domain shadix.to, registered on 2025-05-04 through a registrar identified as the Government of the Kingdom of Tonga, is currently active and hosts a page titled “QR Code & Mixing Tool for Crypto – Supports BTC, ETH, XMR, USDT, USDC, LTC, SOL”. The site positions itself as an Ethereum‑related service, matching the intelligence tag “brand_impersonation” and the declared brand target Ethereum. Infrastructure analysis shows the domain resolves to IP address 104.21.93.86, a Cloudflare‑provided address located in the United States and associated with ASN 13335 (Cloudflare, Inc.). The site is served over HTTPS using a certificate issued by Google Trust Services under the WE1 root, and its DNS is managed by the Cloudflare nameservers meera.ns.cloudflare.com and porter.ns.cloudflare.com. HTTP response code 200 is returned, and traffic is observed to employ Cloudflare Browser Insights and HTTP/3, confirming the use of Cloudflare’s performance and security stack. Reputation services report a Gridinsoft trust score of 0 out of 100, and VirusTotal flags the domain in 14 of 95 scanning engines, indicating a substantial malicious consensus. The domain appears on one external blocklist and has been manually blocked by PhishDestroy. While the page title suggests a crypto‑mixing or QR‑code service, no additional content has been captured, so the exact phishing mechanics remain unverified. Defenders should treat shadix.to as a high‑risk malicious actor targeting Ethereum users, enforce blocklisting at firewall and DNS layers, monitor for related traffic to the Cloudflare IP range, and consider updating intrusion‑detection signatures to include the observed hostnames and certificate fingerprint. Ongoing observation is recommended to detect any evolution of the payload or credential‑harvesting components.