cardano-ada-mixer[.]com

Analysis of the domain cardano-ada-mixer.com shows a short‑lived infrastructure that was registered through NameCheap, Inc. on February 21, 2026. The domain is delegated to the Namecheap hosting name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com and resolves to the IP address 162.0.229.126, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. The site presented a page titled "CKTOGEL: Pasaran Togel dan Slot Online Terbaik" and was built with PHP, LiteSpeed, AMP and jQuery, indicating a generic web stack rather than a specialized phishing kit. An SSL certificate issued by Let’s Encrypt (R12) was active at the time of collection, providing HTTPS encryption but no indication of legitimate ownership.

VirusTotal scans recorded 7 detections out of 93 security vendors, confirming that multiple scanners flagged the domain as malicious. Independent blocklists, including PhishDestroy and Enkrypt, have listed the domain, and it appears on two additional security blocklists, reinforcing the consensus that the site was being used for malicious purposes. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, further underscoring its malicious nature. The current status is offline, which suggests the operators have taken the site down, possibly in response to takedown actions or detection.

While the exact phishing payload or credential‑harvesting mechanisms have not been captured, the combination of a deceptive page title, low trust score, multiple vendor detections, and blocklist listings provides strong evidence that the domain was employed in a crypto‑focused phishing campaign targeting users interested in Cardano or ADA mixers. Defenders should continue to block the domain and associated IP address, monitor for any re‑use of the hosting infrastructure, and incorporate the observed indicators of compromise into web‑filtering and threat‑intel feeds.