mixer-money[.]org

The domain mixer-money.org was registered on February 21, 2026 and presently resolves to the IPv6 address 2a06:98c1:3121::3, which is advertised as belonging to the United States and is hosted within AS13335 (Cloudflare, Inc.). The site presents a Russian‑language page title that reads "Биткоин миксер | Миксер биткоинов - mixer-money.org", indicating a focus on cryptocurrency mixing services. An SSL certificate issued by GTS CA 1P5 is active for the domain, confirming that TLS is employed, but the certificate does not mitigate the underlying malicious intent. Malware and URL reputation scanning on VirusTotal recorded a single detection out of 93 security vendors, indicating that at least one vendor flagged the domain as malicious.

Independent assessment by Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy. The domain is presently listed on one public security blocklist and has been actively blocked by the PhishDestroy service. Current network checks show the site is offline, which suggests the operators have taken the infrastructure down or it has been forcibly removed.

Despite the offline status, historical evidence of phishing activity warrants continued monitoring. Defenders should ensure that any internal references to mixer-money.org are blocked at the DNS and proxy layers, verify that no client systems have cached the site’s content, and consider adding the domain to threat‑intel feeds used by intrusion detection systems. Ongoing vigilance is advised, as the underlying infrastructure (Cloudflare hosting) could be reused for future campaigns.