mixer-usdt-erc20[.]com

The domain mixer-usdt-erc20.com is identified as a phishing resource specializing in brand impersonation targeting Ethereum, specifically masquerading as a cryptocurrency mixing service for USDT ERC20 tokens. Analysis confirms the domain is designed to deceive users into believing it offers anonymous Tether transactions without KYC verification, a common tactic to exploit trust in decentralized finance platforms. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat vector. Infrastructure analysis reveals the domain was registered on August 18, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.63.140, a Cloudflare-hosted endpoint leveraging HTTP/3 and a Let’s Encrypt SSL certificate to appear legitimate. Detection metrics indicate elevated risk: the domain was flagged by 5 of 95 security vendors on VirusTotal, assigned a Gridinsoft trust score of 0/100, and appears on one security blocklist, specifically PhishDestroy. These indicators align with patterns observed in cryptocurrency-related phishing campaigns, where low detection thresholds and rapid takedowns are typical. Current status confirms the domain is offline, mitigating immediate user exposure. However, the infrastructure and registration patterns suggest potential for reemergence under similar or altered domains. Organizations and individuals are advised to block the domain and its associated IP (104.21.63.140) at the network level, monitor for lookalike domains registered through NiceNIC, and educate users on the risks of unverified cryptocurrency mixing services. Security teams should correlate this domain with other Ethereum-themed phishing campaigns to identify broader threat clusters.