ethmix[.]xyz

Analysis of ethmix.xyz indicates a cryptocurrency-themed phishing domain with elevated risk based on infrastructure and detection data. The domain was registered on June 28, 2025, through GMO Internet Group, Inc. d/b/a Onamae.com, and is currently offline, returning an HTTP 403 status. It resolves to an IPv6 address (2a02:26f0:480:5a6::1771) associated with AWS Global Accelerator in Canada, a common hosting choice for malicious campaigns due to its resilience and global reach. The domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 91 security vendors in VirusTotal, though the specific detection rules are not disclosed in the available data.

Infrastructure reveals the use of Akamai technologies, which may indicate content delivery or proxy services, and an SSL certificate issued by GoDaddy.com, Inc. (Go Daddy Secure Certificate Authority - G2). The absence of valid MX records suggests the domain is not configured for email, a common trait in phishing domains designed for short-term abuse rather than sustained communication. The page title, matching the domain name (ethmix.xyz), provides no additional context about the intended target or scam type, though the domain name itself implies a focus on Ethereum or cryptocurrency-related fraud. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's high-risk classification.

While the domain is currently offline, defenders should treat it as active in monitoring systems due to the potential for reactivation. Network-level blocking is recommended for the domain and its associated IP, particularly in environments handling cryptocurrency transactions. Further investigation into related domains registered through the same registrar or hosted on similar infrastructure may uncover additional threats. No evidence of a specific phishing kit or brand impersonation is present in the available data, limiting attribution beyond the generic cryptocurrency phishing classification.