mixhura[.]money

This domain, mixhura.money, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the domain is currently offline, though it previously hosted active phishing infrastructure. No specific brand impersonation has been confirmed, but the page title 'MIXTURA' suggests an attempt to mimic legitimate services or products. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolves to the IP address 188.114.97.3. Detection metrics show the domain is flagged by 6 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. It appears on one security blocklist and employs technologies including Node.js, Express, and Cloudflare services. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to malicious domains. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for related domains registered through the same registrar, particularly those created in close temporal proximity. End-users should be educated on recognizing credential harvesting attempts, especially those leveraging Cloudflare-protected infrastructure to evade detection.