sinbad[.]io

This domain, sinbad.io, is flagged as a fraudulent cryptocurrency mixer service designed to deceive users into disclosing wallet credentials and private keys. Analysis indicates the site mimics legitimate privacy tools, commonly targeting cryptocurrency holders seeking transaction anonymity. The infrastructure is engineered to capture sensitive financial data, which can lead to unauthorized asset transfers and irreversible fund losses. The threat primarily exploits trust in privacy-focused services, leveraging social engineering to manipulate victims into interacting with malicious interfaces or downloading compromised software. Infrastructure analysis reveals sinbad.io was registered through Sarek Oy on June 26, 2019, and currently resolves to the IP address 188.114.97.3. The domain appears on two security blocklists and is flagged by 7 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection across threat intelligence platforms. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Historical DNS records and passive SSL certificate analysis suggest the domain has been repurposed multiple times for similar fraudulent activities, with periodic reactivation following takedowns. Users who visited sinbad.io or interacted with its content should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. All devices used to access the domain should undergo a full malware scan using updated security tools to detect potential backdoors or credential-stealing malware. Monitor transaction histories for unauthorized activity and enable multi-factor authentication on all cryptocurrency exchange accounts. If credentials were entered, assume they are compromised and avoid reusing passwords across platforms. Report the incident to relevant financial and cybersecurity authorities to assist in tracking the threat actors.