whirmix[.]com

This domain, whirmix.com, is flagged as a high-risk brand impersonation site targeting Telegram users. Registered on June 10, 2025, through NiceNIC International Group Co., Limited, the domain presents itself as a Bitcoin mixing service, as indicated by its page title: 'Whir Bitcoin Mixer | Whir BTC Blender & Whir Tumbler.' The site is classified as a social media phishing operation, though the exact mechanics of the deception remain unverified due to the absence of direct page analysis. Infrastructure analysis reveals the domain resolves to IP address 172.67.132.39, hosted on Cloudflare's network (AS13335) with nameservers izabella.ns.cloudflare.com and shane.ns.cloudflare.com. The site employs HTTP/3 and returns a 200 HTTP status, suggesting active hosting. The SSL certificate issued by Google Trust Services (WE1) provides a layer of encryption, though this is not indicative of legitimacy. Security vendors have flagged the domain in four out of ninety-five VirusTotal scans, while it appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The use of Cloudflare infrastructure is consistent with threat actors leveraging content delivery networks to obscure hosting origins and evade takedowns. At present, the domain remains active, with no evidence of remediation or suspension. Defenders should prioritize blocking the domain and its associated IP address (172.67.132.39) at the network level. Monitoring for related domains registered through the same registrar or utilizing identical Cloudflare nameservers may help identify additional threats. Given the impersonation of Telegram and the promotion of a Bitcoin mixing service, this domain likely targets users seeking anonymity in cryptocurrency transactions, though the precise payload or phishing mechanism remains unconfirmed without further analysis.