anonymixer-mixer2[.]vip

PhishDestroy identifies anonymixer-mixer2.vip as an active cryptocurrency drainer scam infrastructure posing imminent risk to Web3 users. The domain was registered on March 29 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the bulletproof-hosting IP 188.114.96.3. The campaign leverages a free Let's Encrypt SSL certificate to appear legitimate and currently shows zero detections on VirusTotal (3 of 95 engines) despite weaponized JavaScript payloads that monitor clipboard activity and automatically swap crypto addresses upon detection of a wallet string. No public blocklists have yet flagged the domain, and domain trust scoring tools place its reputation below threshold due to its recent creation and hosting profile, indicating early-stage deployment targeting unsuspecting users searching for “mixer” services.

Technical indicators confirm this is a wallet-draining operation rather than generic credential harvesting. The SSL certificate (issuer CN = Let’s Encrypt R3) terminates on IP 188.114.96.3 which belongs to the known bulletproof range 188.114.96.0/20 operated by Cloudflare and listed by multiple abuse feeds for prior cryptocurrency abuse. Domain creation timestamp (2026-03-29) is unusually recent for a campaign of this sophistication, suggesting rapid domain cycling to evade detection. VirusTotal’s current 3/95 detection ratio highlights the need for behavioral and heuristic analysis rather than signature matching alone. Registrar NICENIC has a history of bulk registrations with weak abuse enforcement, enabling this threat actor to maintain infrastructure continuity.

Immediate mitigation is required to prevent fund loss. Users must stop all interaction with anonymixer-mixer2.vip, including wallet address copy-paste operations and any click-through “mixing” prompts. PhishDestroy recommends mandatory address verification via hardware wallets when executing transfers and the use of browser extensions that flag known drainer domains. Report the IP and domain to your wallet provider’s abuse desk and consider blacklisting 188.114.96.3 at network egress. Enable clipboard sanitization features in browser privacy settings and consider DNS sinkholing of the IP until global blocklists catch up. Always verify any crypto service URL manually via official channels before entering transaction details.