ardruastudio[.]com

This domain, ardruastudio.com, is a confirmed phishing site that remains active as of the report date of July 21, 2026. It is flagged by three security blocklists and blocked by PhishDestroy, MetaMask, and SEAL. On VirusTotal, 2 out of 95 security vendors currently flag this domain as malicious, indicating a moderate but clear detection rate. The domain was registered on July 3, 2016, through NAMECHEAP INC, which is a common registrar for both legitimate and malicious domains.

Its nameservers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, and it resolves to the IP address 158.94.209.40. The IP is not associated with a specific ASN or country in the available intelligence. The exact content of the site has not been analysed, and no brand target, scam type, or page title is provided in the intelligence. Defenders should treat this domain as a high-risk threat due to its active status and presence on multiple blocklists.

The creation date in 2016 suggests the domain may have been aged for credibility or repurposed for phishing. Recommended actions include blocking the domain and its IP at the network level, adding it to email and web gateway filters, and monitoring for any associated subdomains or similar registrations. Given that the domain is still active, defenders should also check for any internal user interactions or credential submissions that may have occurred, as phishing campaigns using aged domains can be highly effective. Without further data on the phishing kit or target brand, analysts should treat this as a generic phishing threat and apply broad defensive measures until more specific intelligence becomes available.