coinmix-service[.]lima-city[.]de

This domain was registered on 21 February 2026 and is currently hosted on a server owned by AS47447 (23M GmbH) in Germany, resolving to 91.216.248.21. The web service is powered by Nginx with OpenResty and presents a Let’s Encrypt certificate (E8). When accessed, the server returned HTTP 404, while the page title extracted from the host is “coinmix-service.lima-city.de – Zugriff / Access: #403”. The mismatch suggests that the site may have been taken down or reconfigured after initial observation.

The domain is listed on one security blocklist and was blocked by PhishDestroy. VirusTotal scans show two of ninety‑three antivirus engines flagged the domain, indicating some detection of malicious activity. No additional intelligence such as safe‑browsing verdicts, Open Threat Exchange reports, or registrar details were supplied. Because the site is offline, active credential harvesting cannot be confirmed, but the presence of a phishing‑related blocklist entry, the mismatched HTTP response, and the limited vendor detections point to a likely generic phishing campaign targeting users of a coin‑mixing service.

Defenders should add the domain and its resolving IP to DNS‑based deny lists, monitor for any re‑appearance of the host or similar sub‑domains under the lima‑city.de zone, and enforce outbound traffic filtering to block connections to the IP address. Continuous re‑scanning on multi‑engine platforms is advised to detect any changes in the payload or hosting infrastructure. Organizations using cryptocurrency mixing services should educate users on the risk of spoofed URLs and encourage verification of TLS certificates and domain names before entering credentials.