muxado[.]com

Analysis conducted on July 24, 2026 indicates that the domain muxado.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are davina.ns.cloudflare.com and milan.ns.cloudflare.com, directing the domain to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, providing standard HTTPS encryption and HSTS enforcement. Passive fingerprinting of the web service reveals a stack built on Node.js and hosted on Vercel, with client‑side components identified as React, Next.js, and the analytics package Umami.

Cloudflare Browser Insights and generic Cloudflare services are also observed, indicating the use of Cloudflare’s edge network for content delivery and security. The page title returned from the live endpoint reads “Muxado - #1 Proxy Solution,” which does not correspond to any known legitimate brand and is consistent with the generic phishing classification supplied in the intelligence feed. VirusTotal reports that two of ninety‑five scanning engines flagged the domain, and the domain is listed on one external blocklist. PhishDestroy has recorded the site as blocked, and the current operational status is offline, suggesting that the malicious infrastructure has been taken down or is no longer serving content.

While the available evidence confirms the presence of a phishing‑related infrastructure, the specific payload or credential‑harvesting mechanisms have not been publicly disclosed, and no additional indicators such as malicious URLs, email templates, or victim reports are presently available. Defenders should continue to monitor the IP address 188.114.97.3 and the associated Cloudflare range for any reactivation, enforce URL filtering based on the domain name, and consider adding muxado.com to internal blocklists.