bitcoin-mix[.]me

Analysis of bitcoin-mix.me indicates a high-risk domain actively impersonating Ethereum, despite its page title suggesting a Bitcoin mixing service. The domain was registered on July 7, 2024, through NameCheap, Inc., and currently resolves to the IPv6 address 2a02:4780:2b:1671:0:1754:b06:2. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, LiteSpeed, and Hostinger technologies, which are common in both legitimate and malicious sites but provide no definitive classification alone. Security vendors have flagged the domain, with 3 of 95 detecting it as malicious, and it appears on four blocklists, including ScamSniffer, PhishDestroy, Enkrypt, and BLP-Malware. The domain is also referenced in 23 threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious activity. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to the widespread availability of free certificates. Trust scores from Scamadviser and Gridinsoft are critically low (1/100 and 0/100, respectively), reinforcing the domain's high-risk status. While the exact nature of the threat remains unconfirmed beyond brand impersonation, the combination of blocklist presence, vendor detections, and threat intelligence references provides strong evidence of malicious intent. Defenders should treat this domain as compromised and prioritize blocking or monitoring its resolution and associated network traffic. No evidence suggests takedown or mitigation at this time, and the domain remains active as of July 12, 2026.