webmixer[.]to

The domain webmixer.to was registered through Namecheap on August 12, 2025 and currently resolves to the IP address 172.67.187.130. Analysis of open‑source intelligence shows the domain appears on three reputable security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple independent anti‑phishing feeds have identified malicious activity associated with this host. VirusTotal scans have returned five positive detections out of ninety‑one security vendors, reinforcing the suspicion that the site is being used for illicit purposes.

The threat is classified as generic phishing, and the risk level has been assigned as elevated, reflecting the combination of blocklist presence and vendor detections. The domain remains active as of the report date, July 29, 2026, suggesting that the infrastructure is still operational and may be delivering fraudulent content to unsuspecting users. While the specific landing page content, SSL configuration, HTTP response codes, and page title have not been disclosed in the available data, the collective evidence from registrant information, IP resolution, blocklist listings, and vendor detections provides a concrete basis for defensive action.

Defenders should add webmixer.to to local deny lists, monitor DNS queries for look‑ups to the associated IP, and block any outbound traffic to the domain at perimeter devices. Continuous re‑scanning of the host on VirusTotal and inclusion in threat‑intel platforms is recommended to capture any changes in detection counts or new indicator updates. Organizations employing browser protection or phishing‑aware extensions should ensure that the domain is covered by existing blocklist subscriptions, and incident response teams should be prepared to investigate any user reports that reference webmixer.to as a potential lure.