usdtmixer[.]org

The domain usdtmixer.org is currently active and classified as generic phishing with a high risk rating. It resolves to the IPv6 address 2606:4700:3031::ac43:946c, which is hosted by Cloudflare (AS13335) in the United States. The site presents a page title that advertises a "Best USDT Mixer - Anonymize Tether Transactions with a Tumbler for ERC20, TRC20, OP, ARB & BSC in 2025," indicating a lure aimed at cryptocurrency users seeking transaction anonymity. Cloudflare services, including HTTP/3, are observed, and the SSL certificate is issued by Google Trust Services / WE1. The HTTP response code is 523, suggesting the origin server is unreachable or blocked at the time of testing. The domain is listed on one security blocklist and has been flagged by PhishDestroy; Gridinsoft assigns a trust score of 0/100. VirusTotal reports a single vendor detection out of 95, reinforcing the malicious assessment. MX records exist (priority 0, host _dc-mx.46f4ddf91fb8.usdtmixer.org), indicating potential email-based phishing vectors. The domain was registered on October 14, 2025 via NiceNIC International Group Co., Limited and uses Cloudflare name servers craig.ns.cloudflare.com and sierra.ns.cloudflare.com. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the associated IP, and inspect any related email traffic for the listed MX host. Continuous observation is advised given the active status and ongoing phishing classification.