mixfura[.]money

The domain mixfura.money has been identified as a phishing site impersonating the MIXTURA brand. Analysis confirms this domain as a generic_phishing threat, currently marked offline. The site targeted users by mimicking legitimate MIXTURA services, likely aiming to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolves to the IP address 172.67.133.174, a Cloudflare-hosted endpoint. It is flagged by 6 of 95 security vendors on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, SEAL, and PhishDestroy. Detected technologies include Node.js, Express, Cloudflare, and HTTP/3, suggesting a modern, obfuscated attack infrastructure. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to update web filtering rules to block mixfura.money and its associated IP 172.67.133.174. Security teams should monitor for credential reuse attempts or secondary infections linked to this campaign. End-users should verify domain authenticity before entering sensitive information and report any suspicious activity to their security operations center.