trustmixer[.]to

Analysis on trustmixer.to, identified as a brand‑impersonation site targeting Telegram, shows that the domain was registered through NameCheap on 12 August 2025 and subsequently assigned Cloudflare’s authoritative nameservers jose.ns.cloudflare.com and tegan.ns.cloudflare.com. The domain resolves to 172.67.155.79, an IP owned by AS13335 Cloudflare, Inc., geolocated to the United States. No TLS certificate is present, indicating that HTTPS connections are not provisioned. Page metadata reveals the title “TrustMixer.to — TrustMixer”, which does not reference the Telegram brand but aligns with the impersonation classification supplied.

The site has been blocked by the PhishDestroy feed and appears on a single security blocklist, suggesting that at least one anti‑phishing service has taken action. Gridinsoft’s trust score assigns a value of 0 / 100, reflecting a highly suspicious reputation. VirusTotal has processed the domain with 95 scanning engines, none of which reported a detection; this absence of flags does not constitute a safety statement.

The domain is currently marked as offline, and no active web service responded to HTTP requests at the time of assessment. Given the observed infrastructure—Cloudflare front‑end, lack of TLS, low trust score, and inclusion on blocklists—defenders should continue to block the domain at the network perimeter, update DNS‑based filtering policies, and monitor for any re‑appearance or redirection to new infrastructure. Ongoing observation of the associated IP range and related Cloudflare‑hosted domains is advised, as threat actors frequently pivot to new hostnames while retaining the same hosting provider.