webmixer[.]site

The domain webmixer.site was registered on June 04, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the Cloudflare‑hosted address 172.67.215.25, which geolocates to Canada. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and HTTP requests return a 200 status code. Technical fingerprints show the use of Cloudflare Browser Insights, Cloudflare services, and HTTP/3. The page title returned by the server is "WebMixer" and the listed scam type is a Crypto Drainer, indicating an attempt to illicitly acquire cryptocurrency assets from victims. Threat intelligence sources corroborate the malicious classification: AlienVault OTX records the domain in two separate pulses, and three independent blocklists have already flagged it. VirusTotal analysis shows that seven of ninety‑one scanned security engines have flagged the domain, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple defensive platforms have identified it as a phishing vector. While the current evidence confirms the presence of a crypto‑draining phishing operation, the exact content and user‑facing components of the site have not been publicly disclosed, leaving the specific tactics and lure mechanisms uncertain. Defenders should continue to block webmixer.site at network and endpoint layers, monitor for any related C2 traffic originating from the Cloudflare IP range, and update detection signatures to include the observed SSL certificate chain and HTTP/3 fingerprint. Organizations should also educate users about unsolicited cryptocurrency requests and advise them to verify any such communications through trusted channels before interacting with the site.