mixtum[.]vip

The domain mixtum.vip has been identified as a brand impersonation threat specifically targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users by mimicking legitimate services, presenting itself under the title 'MixTum - Bitcoin Mixer & Tumbler | Anonymous BTC Mixing.' This domain is currently offline, though its prior activity and infrastructure warrant elevated scrutiny. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited, with a creation date of December 22, 2025. It resolves to the IP address 172.67.181.180 and has been flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Additional threat intelligence sources report the domain’s presence on three security blocklists, while Gridinsoft assigns it a trust score of 0 out of 100. The domain also appears in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. Protective measures from network-level security tools, including MetaMask and SEAL, have been observed blocking access to this domain. Given the domain’s current offline status, the immediate risk of active exploitation is reduced; however, the underlying infrastructure and registration details suggest potential for re-emergence. Organizations and end-users are advised to maintain blocklist entries for this domain and its associated IP address. Security teams should monitor for renewed activity under similar naming conventions or registrant details. Users who may have interacted with this domain should verify account integrity, particularly for cryptocurrency-related services, and report any unauthorized transactions to the appropriate platform. Proactive measures, such as DNS filtering and endpoint protection updates, are recommended to mitigate future exposure to similar threats.