bagsmixer[.]com

The domain bagsmixer.com was registered on March 05, 2026 through NameCheap, Inc. and is currently active. It is listed on one security blocklist and has been flagged by PhishDestroy as a high‑risk generic phishing site. The site presents the page title “BAGSMIXER” and returns an HTTP 307 response, indicating a redirection behavior typical of credential‑harvesting portals.

Infrastructure analysis shows the domain resolves to IP address 216.198.79.1, which belongs to Amazon.com, Inc. (AS16509) in the United States. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, confirming that the site is hosted on the Vercel platform. A Let’s Encrypt certificate (R13) is in use and HTTP Strict Transport Security (HSTS) is enforced, providing a valid TLS connection that may increase user trust.

VirusTotal reports that 2 of 95 scanned security vendors have flagged the domain, suggesting limited but non‑trivial detection across the ecosystem. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single blocklist, indicating that many security products have not yet identified it as malicious. The combination of a recent registration date, active status, and the presence of a generic phishing page title supports the classification as a high‑severity phishing infrastructure, though the low vendor count leaves some uncertainty about the full scope of the campaign.

Defenders should add bagsmixer.com to URL filtering and DNS blocklists immediately, and monitor the associated IP address 216.198.79.1 for any anomalous traffic. Because the site uses a valid TLS certificate and HSTS, endpoint solutions that rely solely on certificate reputation may miss the threat; therefore, behavioral detection of credential‑submission flows is recommended. Continuous re‑evaluation of the domain’s detection status is advised, as additional security vendors may raise their detection scores as more intelligence becomes available.