cardanomix[.]com

This domain, cardanomix.com, is flagged as a brand impersonation threat targeting Scroll, a blockchain platform. Analysis of the page title, "CardanoMix," suggests an attempt to mimic legitimate cryptocurrency mixing services while exploiting the Scroll brand to deceive users. No explicit drainer kit signatures were identified, but the domain aligns with patterns observed in cryptocurrency-related phishing campaigns designed to harvest credentials or wallet information.

Infrastructure analysis reveals the following technical indicators: the domain was registered on January 17, 2025, through IONOS SE and resolves to the IP address 18.208.88.157. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Sectigo Limited, a common provider for both legitimate and malicious domains. Google Safe Browsing (GSB) status is not explicitly listed, but the domain has been blocked by at least one security filter.

The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated. Historical data indicates a low trust score (0/100 by Gridinsoft, 41/100 by Scamadviser), reinforcing its classification as a high-risk asset. Organizations and users are advised to monitor for reactivation, block the domain at the network level, and verify any communications claiming affiliation with Scroll through official channels. Cryptocurrency users should exercise caution with wallet interactions and validate domain authenticity before entering sensitive information.