nadoperps[.]pro

Analysis of nadoperps.pro identifies it as an active phishing domain targeting users of decentralized exchange platforms, specifically impersonating the Ink Protocol. The domain was registered on May 5, 2026, through Global Domain Group LLC and currently resolves to the IP address 104.21.27.159, hosted on Cloudflare infrastructure in Canada. The site presents itself as 'Nado Orderbook DEX | Unified Perps & Spot on Ink,' a title designed to mimic legitimate decentralized finance services, likely to deceive users into interacting with malicious smart contracts or disclosing private keys. Infrastructure analysis reveals the domain uses Cloudflare nameservers (athena.ns.cloudflare.com and jasper.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt, which provides a false sense of security. While VirusTotal currently shows 0 detections out of 95 engines, this does not indicate safety; rather, it reflects the domain's recent registration and limited exposure. The domain has been flagged by three security blocklists and appears in one AlienVault OTX threat intelligence pulse, confirming its malicious classification by independent sources. The HTTP status code 200 indicates the site is fully operational, and its Gridinsoft trust score of 0 out of 100 further supports its high-risk designation. Defenders should treat this domain as a confirmed phishing threat, particularly for users of decentralized finance platforms. Network-level blocking of 104.21.27.159 and the domain itself is recommended, alongside monitoring for related subdomains or IP shifts, as threat actors frequently rotate infrastructure. Given the domain's recent creation and active status, continued vigilance is advised, as additional payloads or credential-harvesting mechanisms may still emerge.