whir[.]ltd

Analysis of the domain whir.ltd indicates a high-risk crypto scam operation impersonating Facebook infrastructure. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 172.67.142.249, hosted on Cloudflare's network (AS13335) in the United States. The site returns an HTTP 200 status, signaling an active web server, and employs Cloudflare services alongside jQuery and HTTP/3 technologies. The page title, 'Whir - Bitcoin Mixer | Anonymous BTC Mixing Service,' explicitly identifies the site as a cryptocurrency mixing service, a common front for illicit financial activities. Infrastructure evidence further supports the fraudulent classification.

The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically target phishing and scam domains. Two of 93 security vendors on VirusTotal flag whir.ltd as malicious, though the absence of broader detection does not confirm safety. The SSL certificate, issued by Let's Encrypt, is valid and provides encrypted connections, a tactic often used to lend legitimacy to fraudulent sites. Nameservers are hosted under Cloudflare (shane.ns.cloudflare.com and izabella.ns.cloudflare.com), a pattern observed in both legitimate and malicious domains leveraging Cloudflare's privacy and security features. The scam type is classified as a crypto scam, aligning with the page title's indication of Bitcoin mixing services.

While the domain impersonates Facebook in its broader infrastructure, the content does not appear to directly mimic Facebook's branding or services. Defenders should treat this domain as active and high-risk, particularly for users involved in cryptocurrency transactions. Blocking access at the network level and monitoring for related domains registered through the same registrar or hosted on Cloudflare's infrastructure is recommended.