ethereum-mixer[.]vip

ethereum-mixer.vip was observed resolving to the IPv4 address 152.89.61.96. The host is registered to AS30860 Virtual Systems LLC and geolocated to Ukraine. WHOIS data shows the domain was registered on 21 February 2026, indicating a recent creation date typical of fast‑flux or opportunistic abuse. The site presented the page title “VIP Ethereum Mixer – Premier ETH Privacy Solution”, directly referencing the Ethereum brand and positioning itself as a privacy‑focused mixing service.

The SSL certificate associated with the domain is identified as “R11”, which does not correspond to a publicly trusted CA and suggests a self‑signed or low‑trust certificate. VirusTotal analysis recorded 12 positive detections out of 93 scanned engines, confirming that multiple security vendors consider the domain malicious. Gridinsoft assigned a trust score of 0 / 100, reinforcing the low reputation. The domain was listed on a single external blocklist and was actively blocked by the PhishDestroy service, which has taken the site offline as of the report date.

The infrastructure analysis indicates that the operator is attempting to impersonate Ethereum to lure cryptocurrency users into a mixing scam, but no further technical details such as payloads, redirects, or credential‑stealing forms have been publicly released. Defenders should continue to block the IP 152.89.61.96 at the network perimeter, add ethereum-mixer.vip to URL filtering and threat‑intel feeds, and monitor for any re‑registration or resurrection of the domain. Because the site is currently offline, real‑time traffic observation is not possible, but threat‑intel platforms should be queried for any resurgence or related domains sharing the same ASN or hosting provider. Continuous vigilance is recommended given the recent creation date and the targeted brand impersonation.