cosmos-mixer[.]com

This domain, cosmos-mixer.com, was registered on February 21, 2026, through NiceNIC International Group Co., Limited and has been classified as a generic phishing site. Analysis indicates the domain resolved to the IPv6 address 2606:4700:3031::ac43:8ada, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain utilized Cloudflare nameservers (keanu.ns.cloudflare.com and virginia.ns.cloudflare.com) and employed HTTP/3 protocol, consistent with Cloudflare’s infrastructure. The SSL certificate was issued by Google Trust Services under the WE1 intermediate, further aligning with Cloudflare’s typical configuration.

As of July 24, 2026, the domain is offline, displaying a Cloudflare interstitial page titled 'Suspected phishing site.' This status suggests Cloudflare’s automated systems or manual review flagged the domain for phishing activity. Detection data from PhishDestroy confirms the domain was blocked by at least one security vendor, and it appears on a single security blocklist. VirusTotal reports one of ninety-three security vendors flagged the domain, though the specific detection context is not detailed in available intelligence. The domain’s registration and hosting patterns do not exhibit immediate anomalies beyond its use of Cloudflare, a common service for both legitimate and malicious sites.

The absence of widespread detection does not imply safety, as phishing domains often evade initial scans. Defenders should treat this domain as a confirmed phishing threat, particularly if it resurfaces or is referenced in logs. Monitoring for re-registration or changes in resolution is recommended, given the domain’s prior association with malicious activity. No specific brand or scam subtype is identified in the available data, limiting further classification.