mixtkra[.]money

This domain, mixtkra.money, is identified as a credential theft phishing site targeting users through brand impersonation. The page title 'MIXTURA' suggests an attempt to mimic a legitimate entity, likely to deceive visitors into submitting sensitive login credentials or personal information. No direct evidence of a crypto drainer kit was observed, but the infrastructure and techniques align with credential harvesting campaigns commonly used in follow-up financial fraud or account takeover attacks. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.75.68 and is associated with technologies including Node.js, Express, and Cloudflare. The domain appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to malicious sites. No detections were reported by Google Safe Browsing at the time of analysis. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered, and the threat actor may re-deploy the site or repurpose the domain for future campaigns. Organizations should monitor for any re-emergence of this domain or similar patterns, such as newly registered domains with the 'MIXTURA' branding. Network-level blocking of the IP 104.21.75.68 and related Cloudflare ranges is recommended to mitigate residual risk. Users who may have interacted with this domain should reset credentials and enable multi-factor authentication on all critical accounts.