mixtum[.]io

This domain, mixtum.io, is flagged as an active crypto drainer phishing site operating since February 21, 2026. Analysis indicates the domain is registered through NameCheap, Inc. and currently resolves to 104.21.71.236, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The domain employs Cloudflare nameservers (dawn.ns.cloudflare.com and zod.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. A Google Trust Services SSL certificate (WE1) is present, which may lend a false sense of legitimacy to potential victims. Infrastructure analysis reveals the use of Proton Mail, suggesting email-based communication channels are part of the attack vector. The domain is blocked by at least one security provider and appears on one public blocklist, while AlienVault OTX records it in a single threat intelligence pulse. Four out of ninety-five security vendors on VirusTotal have flagged mixtum.io, though the absence of broader detection does not imply safety. The HTTP response code is 403, indicating access restrictions, which may be a deliberate measure to limit analysis or automated scanning. The exact content of the site remains unconfirmed, as the only visible page title is 'Just a moment...', a default Cloudflare interstitial. However, the domain is explicitly classified as a crypto drainer, a type of phishing attack designed to siphon cryptocurrency from victims' wallets. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, IP, and certificate levels. Network security teams are advised to monitor for connections to 104.21.71.236 and review logs for any interactions with mixtum.io or associated Proton Mail addresses. Given the domain's recent creation and active status, further monitoring is recommended to track potential shifts in infrastructure or attack methods.