coinjoin[.]app

This domain, coinjoin.app, is currently flagged as an active high-risk phishing site specializing in brand impersonation targeting Bitcoin. Analysis indicates the domain is designed to deceive users by mimicking legitimate Bitcoin CoinJoin mixing services, as evidenced by its page title, 'Bitcoin CoinJoin Mixer – Anonymous BTC CoinJoin Service.' The site is operational and poses a significant threat to individuals seeking privacy-enhancing cryptocurrency tools. Infrastructure analysis reveals the domain was registered through PublicDomainRegistry and resolves to the IP address 157.173.127.194. Security vendor assessments show that 3 of 95 engines on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (serial number E8), which, while providing encryption, does not validate the legitimacy of the site’s operations. No historical registration data or creation date was provided, but the active status and detection metrics confirm ongoing malicious activity. The current status of coinjoin.app remains active, and the risk level is classified as high due to its direct targeting of cryptocurrency users. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of any cryptocurrency-related service through official channels. Network administrators should consider blocking the IP address 157.173.127.194 and implementing domain-based filtering to mitigate exposure. Cryptocurrency wallet providers and exchanges are recommended to monitor for transactions originating from or interacting with this domain and its associated infrastructure.