mixoorfun[.]xyz

This domain, mixoorfun.xyz, is identified as a brand impersonation threat targeting cryptocurrency users through a fraudulent MIXOOR airdrop scheme. The domain is currently offline, but prior activity suggests it was designed to deceive victims into participating in a fake token distribution event, likely to facilitate unauthorized access to digital wallets or the extraction of sensitive credentials. The page title, $MIXOOR Airdrop, directly references the impersonated brand, reinforcing its deceptive intent. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.150.200, hosted on infrastructure associated with AS13335 (Cloudflare, Inc.), a common obfuscation tactic used by threat actors to mask their true origin. Security vendors on VirusTotal flagged the domain as malicious, with 11 out of 95 engines detecting it. Additionally, the domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1), which, while not inherently malicious, is often leveraged to lend a false sense of legitimacy to phishing sites. The domain has been blocked by at least one security provider, further corroborating its malicious classification. The current offline status of mixoorfun.xyz does not eliminate the risk, as threat actors frequently rotate domains or reactivate them under similar names. Organizations and individuals are advised to proactively block the domain and its associated IP address (172.67.150.200) at the network level to prevent potential exposure. End-users should be educated on the risks of interacting with unsolicited airdrop promotions, particularly those disseminated via social media or messaging platforms. Cryptocurrency wallet addresses or transaction hashes linked to this domain should be treated as high-risk and monitored for suspicious activity. Security teams are encouraged to review historical DNS and web proxy logs for connections to this domain to assess potential compromise. If the domain reappears under a different registrar or hosting provider, it should be re-evaluated for updated indicators of compromise.