mixtyra[.]money

The domain mixtyra.money is identified as a cryptocurrency phishing site designed to harvest user credentials and facilitate unauthorized asset transfers. Analysis confirms the domain operates under the generic_phishing threat classification, with infrastructure tailored to impersonate legitimate cryptocurrency platforms. Currently, the domain is offline, though prior activity suggests it may re-emerge under similar or altered infrastructure. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 2 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It resolves to the IP address 188.114.97.3 and is registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain was created on February 21, 2026, an anomalous future date likely indicative of falsified registration data. It appears on one security blocklist and employs Cloudflare for traffic obfuscation, alongside Node.js and Express for backend operations. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while masking malicious intent. Given the elevated risk level and confirmed phishing activity, this domain should be treated as a persistent threat. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Security teams should monitor for re-registration attempts or domain variations, particularly those leveraging similar naming conventions or infrastructure patterns. End-users should be educated on recognizing cryptocurrency phishing attempts, with emphasis on verifying platform authenticity before entering credentials or initiating transactions. Proactive measures, including DNS filtering and endpoint protection updates, are recommended to mitigate potential re-emergence.