ethmixer[.]lol

The domain ethmixer.lol was registered on 19 October 2025 through CSL Computer Service Langenbach GmbH d/b/a joker.com. It resolves to the Cloudflare‑owned address 172.67.71.114, located in the United States under ASN 13335. The site was configured with the Cloudflare nameservers damiete.ns.cloudflare.com and elisa.ns.cloudflare.com, but no TLS certificate was observed, indicating an unencrypted HTTP service at the time of analysis. The page title returned by the host reads “Ethereum Mixer | Eth Tumbler - Ethmixer.org | Secure Crypto Mixing”, and the listed brand target is Ethereum, classifying the operation as a crypto‑related brand impersonation scam.

VirusTotal recorded five detections out of ninety‑five scanning engines, and the domain appears on a single external blocklist. PhishDestroy has taken the domain offline, and its current HTTP status is reported as taken offline. Gridinsoft assigned a trust score of 1 out of 100, reinforcing the malicious assessment.

Despite the offline status, the infrastructure components – Cloudflare IP, registrar, and lack of SSL – remain reusable for future campaigns. Defenders should continue to block the domain and its resolving IP, monitor for new domains registered with the same registrar or using the same nameservers, and consider adding the IP to network‑level deny lists. Ongoing vigilance is recommended because the underlying hosting provider can be leveraged to launch additional impersonation sites targeting Ethereum users.