usdt8mixer[.]com

Analysis of the domain usdt8mixer.com indicates a confirmed cryptocurrency mixer scam actively impersonating the Across protocol, a cross-chain bridging service. The domain, registered on June 26, 2025, through NiceNIC International Group Co., Limited, currently resolves to the IP address 172.67.191.251, which is associated with Cloudflare infrastructure. The site explicitly presents itself as an 'Anonymous Tether Mixer – Multichain USDT Tumbler,' a service type commonly associated with illicit cryptocurrency laundering and obfuscation of transaction trails. Infrastructure analysis reveals the use of Bootstrap and jQuery for frontend development, alongside Cloudflare services, which may be leveraged to mask the true origin of the server and evade takedown efforts. The presence of HTTP/3 further suggests an attempt to optimize performance and resilience. The domain is flagged by 4 security vendors on VirusTotal, though the specific detection categories remain unconfirmed. Additionally, the domain appears on two security blocklists: PhishDestroy and BLP-Malware, reinforcing its classification as malicious. Threat intelligence from AlienVault OTX corroborates these findings, with the domain listed in 25 distinct pulses, indicating widespread recognition as a threat within the security community. The Gridinsoft trust score of 1/100 further underscores the domain's high-risk classification. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as legitimate certificates are frequently abused by malicious actors to lend a false sense of credibility. Defenders are advised to block access to this domain at the network level and monitor for any attempts to interact with it, particularly in environments where cryptocurrency transactions occur. Given the domain's explicit association with Tether (USDT) mixing, financial institutions and cryptocurrency platforms should flag any transactions linked to this domain for further investigation.