anonymixer[.]net

Analysis indicates that the domain anonymixer.net was registered on 18 April 2025 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 172.67.160.232 (AS13335, United States). The site serves HTTP status 200 and presents the page title “Anonymixer - Anonymous Crypto Mixer | Anonymixer BTC Mixer”, which aligns with the listed scam type of a crypto scam. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid HTTPS connection. The domain is protected by Cloudflare and utilizes HTTP/3, consistent with the detected technologies.

Security‑vendor scans on VirusTotal show that three of ninety‑five AV engines flag the domain, and the domain appears on four external blocklists. It is also listed as blocked by PhishDestroy, MetaMask, SEAL, and Enkrypt, reinforcing the malicious classification. Reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 2/100. The brand target is identified as “across”, indicating that the infrastructure is being used for brand impersonation against that entity.

Taken together, the evidence points to an active, high‑risk infrastructure that leverages a legitimate Cloudflare front‑end to host a cryptocurrency‑mixing façade and to impersonate the Across brand for malicious purposes. What remains uncertain is the extent of user interaction data collected and whether additional payloads are delivered beyond the mixer front‑end. Defenders should block DNS resolution for anonymixer.net at the network perimeter, add the domain to web‑filter allow‑lists for known blocklists, monitor outbound connections to the IP 172.67.160.232, and enforce HTTPS inspection to capture any hidden redirects. Continuous re‑analysis is recommended to detect any changes in the hosting or content that could affect mitigation strategies.