ethmixer[.]to

Analysis of ethmixer.to, a domain created on February 22, 2024 and currently taken offline, indicates a high‑risk crypto phishing operation. The site presented itself as a cryptocurrency mixing service, as reflected in the page title "Best Ethereum Mixer - ETH Mixing Service | ethmixer.to," and was classified as a Crypto Scam. Infrastructure checks reveal the domain resolves to IP address 45.12.2.86, which is registered to AS6698 Virtual Systems LLC in Ukraine, and uses the nameservers ns1.zomro.net and ns2.zomro.ru. No SSL certificate was observed, meaning traffic is unencrypted and susceptible to interception.

The registrar records show the domain was registered through the Government of Kingdom of Tonga, a pattern often associated with malicious actors seeking lax oversight. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 38 out of 100, Scamadviser reports a score of 1 out of 100, and the domain appears on two security blocklists. VirusTotal scans flagged the domain by 11 of 95 security vendors, confirming malicious intent. Blocklist aggregators PhishDestroy and Enkrypt have already listed the domain, indicating that defensive feeds are aware of its activity.

While the site is no longer reachable, the observed infrastructure—especially the Ukrainian hosting, lack of TLS, and low trust scores—suggests that similar domains may be provisioned rapidly to target cryptocurrency users. Defenders should continue to monitor the IP range associated with AS6698, enforce blocklisting of the domain and its resolved IP, and update URL filtering policies to include ethmixer.to. Network operators are advised to inspect outbound traffic for connections to this IP and to enforce TLS inspection where feasible to detect attempts to contact similar unencrypted phishing endpoints.