xn--chipmixr-z30d[.]com

This domain, chipmixr-z30d.com, is identified as a brand_impersonation threat specifically targeting ProtonMail users through a fraudulent Bitcoin tumbler service. The site presents itself as ChipMixer, a platform for cryptocurrency mixing, which is a common pretext for credential harvesting and financial fraud. Analysis indicates the domain was designed to exploit trust in ProtonMail’s secure communication brand while facilitating illicit transactions, likely aiming to steal login credentials or cryptocurrency from unsuspecting victims seeking anonymity services. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered on April 26, 2020, through NameCheap, Inc., and resolves to the IP address 162.213.251.90. Security vendors on VirusTotal flagged this domain at a rate of 3 out of 95, a low but notable detection ratio that aligns with targeted or niche threats. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification. The Gridinsoft trust score of 0/100 underscores the absence of legitimate use cases for this infrastructure. Users who visited chipmixr-z30d.com or interacted with its content should take immediate remediation steps. First, revoke any credentials entered on the site, particularly ProtonMail or cryptocurrency wallet logins, as these are likely compromised. Monitor financial accounts and cryptocurrency wallets for unauthorized transactions, as the domain’s Bitcoin tumbler pretext suggests a focus on financial exploitation. If cryptocurrency was transferred to any addresses provided by the site, report the incident to relevant blockchain analysis platforms and law enforcement. Finally, scan local devices for malware, as brand_impersonation domains often distribute payloads to maintain persistence or exfiltrate data.