# PhishDestroy domain threat record: btcmix.services Content language: English Canonical HTML report: https://phishdestroy.io/domain/btcmix.services/ Machine-readable companion: https://phishdestroy.io/domain/btcmix.services/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-29 17:52:48 UTC - Last availability or vendor check: 2026-10-22 10:20:02 UTC - Stored record updated: 2026-10-22 15:44:40 UTC - VirusTotal detections in the stored snapshot: 11/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 198.252.105.119 - Registrar in stored WHOIS data: Gandi SAS - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, btcmix.services): 2023-10-17 11:43:38 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a04ea6-49ce-743f-8719-50c0b658a3a7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/btcmix.services - Certificate Transparency search: https://crt.sh/?q=%25.btcmix.services - Web Archive lookup: https://web.archive.org/web/*/https://btcmix.services/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview btcmix.services presents itself as BTCMix Services and targets Bitcoin holders looking for a coin-mixing service. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-08-29. Its page title, "BTCMix Services | Best Crypto Mixers 2026", reads like a mixer review or ranking site, while our classification treats it as an impersonation of a mixing brand. As of 2026-10-19 the server was still responding, but the domain's DNS was no longer serving the page content. How the scam works Fake mixers work on trust that cannot be checked. The visitor is told to send coins to a deposit address and promised "clean" coins back at a new address after a fee, but the operator simply keeps the deposit. A "best mixers" framing adds credibility, because the site appears to compare services before steering visitors to the one it controls. Bitcoin transfers are irreversible, and mixer users are often reluctant to report losses, so anything sent is very likely gone. Evidence On 2026-10-07, 11 of 92 VirusTotal engines flagged the domain, including alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That count is moderate, but the vendors are independent of each other, which supports the verdict. The domain is also listed by MetaMask and SEAL alongside PhishDestroy, so wallet users relying on those lists receive warnings. Four AlienVault OTX pulses reference it, which means other researchers have tracked it as well. Infrastructure The domain was registered through Gandi SAS on 2023-10-17, nearly three years before PhishDestroy detected it. An aged domain like this can pass reputation checks that trip up freshly registered ones. The site is hosted in the US on Hawk Host Inc. shared hosting. What to do If you sent Bitcoin to this site, do not send more to "unlock" or speed up a payout, because additional fees only add to the loss. Save the transaction ID and the deposit address you were given. If the coins came from an exchange, report the transfer to that exchange so the address can be flagged. Ignore anyone offering to recover the funds for a fee, since recovery offers are a common follow-up scam. Defenders should block the domain at DNS and proxy level and check logs for past visits from users who may have been drawn in by mixer comparison pages. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a04ea6-49ce-743f-8719-50c0b658a3a7/ VirusTotal report: https://www.virustotal.com/gui/domain/btcmix.services Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcmix.services Archived copy: https://web.archive.org/web/20260917063936/https://btcmix.services/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:59:05 UTC ## Stored page captures - Primary capture: https://i.ibb.co/bjKSFZHb/76d915a07294.png Captured: 2026-08-29 17:52:48 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a04ea6-49ce-743f-8719-50c0b658a3a7.png Captured: 2026-08-29 17:52:48 UTC Source report: https://urlscan.io/result/01a04ea6-49ce-743f-8719-50c0b658a3a7/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:28:08Z", "uuid": "01a04ea6-49ce-743f-8719-50c0b658a3a7", "scanned_at": "2026-08-29T17:52:03Z", "final_url": "https://btcmix.services/", "status": 200, "ip": "198.252.105.119", "ptr": "119.105.252.198.static.reverse.arandomserver.com", "ips": [ "198.252.105.119" ], "asns": [ "20068" ], "countries": [ "US" ], "link_domains": [ "unijoin.club", "mixeru.io", "coinomize.biz", "webmixer.to", "anonymix.me", "tormixer.io", "tornadocash-eth.link", "eth-mix.to" ], "doc_hash": "b536e357143355843ae4483dc1fb4737d7a30d8c195cd50ebee5b3d957b5d316", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart" ], "tls": { "san": [ "btcmix.services" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "btcmix.services", "protocol": "TLS 1.3", "valid_to": "2026-10-03T05:13:18Z", "valid_from": "2026-07-05T05:13:19Z" }, "domain_age_days": 1947, "apex_age_days": 1947, "tls_age_days": 55, "tls_valid_days": 89, "requests": 13, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 88, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:38:41Z", "uuid": "987daf54-f1ae-4320-b30a-47fcfcaea908", "scanned_at": "2026-08-29T18:00:27Z", "final_url": "https://btcmix.services/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://btcmix.services/", "status": 307 }, { "url": "https://btcmix.services/", "status": 200 } ], "dom_hash": "9d1037fbac1a9261d84265b9d64a7fdb8437e8ca090be5c367e7ff4663625bb8", "doc_hash": "fe3d6f2bce1a58160ea3528d513382b4329bb9cf41e782db92af3054da0f8f85", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "btcmix.services", "type": "A", "value": "198.252.105.119" } ], "dnssec_valid": false, "ip": "198.252.105.119", "whois": { "registrar": "Gandi SAS", "created": "2023-10-17T11:43:38Z", "updated": "2026-08-12T11:30:53Z", "expires": "2026-10-17T11:43:38Z", "nameservers": [ "ns-157-a.gandi.net", "ns-39-c.gandi.net", "ns-163-b.gandi.net" ] } } } ```