yomix[.]buzz

This domain, yomix.buzz, is currently flagged as an active cryptocurrency wallet phishing site. Analysis indicates it impersonates legitimate digital asset platforms to deceive users into disclosing private keys or transferring funds to attacker-controlled addresses. The domain remains operational despite multiple security detections, posing a significant risk to individuals involved in blockchain transactions. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 04, 2026, an unusually future-dated creation timestamp that may indicate fraudulent registration practices. It resolves to the IP address 172.67.128.88, a host associated with content delivery networks frequently exploited for malicious operations. Security vendors have flagged yomix.buzz with 5 detections out of 95 on VirusTotal, while it appears on three distinct security blocklists including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy to unsuspecting visitors. Current status confirms the domain remains active, continuing to host phishing content. Organizations and individuals are advised to block all connections to 172.67.128.88 and yomix.buzz at the network perimeter. Cryptocurrency users should verify wallet addresses through official channels only and avoid interacting with any domain claiming to represent wallet services without proper validation. Security teams should monitor for outbound requests to this domain and investigate any endpoints that establish connections to it, as this may indicate successful credential compromise or attempted fraud.