coinmixer[.]cc

coinmixer.cc is an active generic phishing domain first observed on November 28, 2025. The domain is registered through Cloudflare, Inc. and is delegated to the default Cloudflare nameservers olga.ns.cloudflare.com and olof.ns.cloudflare.com. DNS resolution points to the single address 188.114.96.3, which is hosted on Cloudflare’s network. Reputation data shows the domain appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services.

VirusTotal analysis reports that six of ninety‑one scanned scanners flagged the domain, indicating a modest but measurable detection rate. No additional public indicators such as SSL certificate details, HTTP response codes, or page title information are presently available, limiting the depth of content‑level analysis. The limited observable infrastructure suggests a low‑cost hosting approach typical of opportunistic phishing campaigns.

Defenders should prioritize immediate DNS or firewall blocking of coinmixer.cc, incorporate the domain into existing URL filtering and email security policies, and monitor outbound connections to the associated IP address for potential data exfiltration. Ongoing threat hunting should include correlation of internal logs for any user‑initiated requests to the domain and periodic re‑query of VirusTotal and blocklist feeds to capture any changes in detection status. Given the elevated risk rating and confirmed presence on multiple blocklists, continuous vigilance is recommended.