joinmarket[.]net

This domain, joinmarket.net, is confirmed to be a brand impersonation scam specifically targeting Bitcoin users by mimicking the legitimate JoinMarket privacy wallet service. The site presents itself as a "Bitcoin Privacy Wallet," likely designed to deceive users into entering sensitive credentials, wallet recovery phrases, or transferring cryptocurrency under false pretenses. Given the domain's focus on Bitcoin and the use of cryptocurrency-related branding, this is assessed as a high-risk threat vector for financial theft or unauthorized access to digital assets.

Analysis indicates the domain was registered on October 28, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. The domain resolves to the IP address 104.21.5.127 and is flagged by 13 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. It appears on one security blocklist and was previously blocked by at least one threat intelligence feed. The site employs Cloudflare for hosting and DDoS protection, alongside Bootstrap for frontend development, which are common among both legitimate and malicious sites but do not mitigate the domain's confirmed fraudulent intent.

Users who visited joinmarket.net or interacted with its content should immediately cease all engagement and take corrective actions. If credentials, wallet recovery phrases, or private keys were entered, affected users must transfer any remaining funds to a new, secure wallet and revoke access to any connected services. Monitor financial transactions for unauthorized activity and report the incident to relevant cryptocurrency platforms or security response teams. Additionally, scan local devices for malware, as phishing sites may distribute secondary payloads or keyloggers. Given the domain's elevated risk level and confirmed malicious status, no further interaction with joinmarket.net is advised.