ethereumixer[.]to

This domain, ethereumixer.to, was identified as a high-risk crypto scam impersonating Ethereum, specifically targeting users with a fraudulent ETH mixing service. Registered on May 24, 2024, through the Government of Kingdom of Tonga, the domain resolved to IP 45.12.2.86 (AS6698, Virtual Systems LLC, Ukraine) and was hosted on nameservers ns1.zomro.net and ns2.zomro.ru. The page title, 'ETH Mixer - Ethereum Tumbler,' explicitly advertised a cryptocurrency mixing service, aligning with the scam type classified as a crypto scam.

As of July 23, 2026, the domain is offline, but prior analysis revealed detection by 15 of 95 security vendors on VirusTotal, with blocklist entries from PhishDestroy, MetaMask, SEAL, and Enkrypt. Trust scores from Gridinsoft and Scamadviser were both 1/100, indicating negligible legitimacy. The SSL certificate was issued by Let's Encrypt (R12), and the site employed Nginx with HSTS enabled, which may have been used to lend a false sense of security.

Defenders should treat this domain as confirmed malicious, particularly in contexts involving Ethereum transactions or cryptocurrency-related communications. No evidence of a phishing kit or additional infrastructure was provided, and the exact content of the site beyond the page title remains unanalyzed. Blocklist entries and vendor detections should be incorporated into existing security controls to prevent user exposure.