cryptomixerbtc[.]net

This domain, cryptomixerbtc.net, was registered on September 18, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The site resolves to the Cloudflare‑hosted address 104.21.90.50, which is advertised as located in Canada. HTTP requests return status 200 and the TLS certificate is issued by Google Trust Services under the WE1 identifier. The page title “Cryptomixer | Bitcoin Mixer | BTC Tumbler” and the declared brand target “Bitcoin” indicate a brand‑impersonation campaign that pretends to offer cryptocurrency mixing services. Infrastructure analysis shows the use of Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, suggesting reliance on a commercial edge platform for anonymity and performance. VirusTotal analysis recorded five detections out of ninety‑one scanners, and the domain appears on three public blocklists. It is also listed in AlienVault OTX in two separate threat pulses, has a Gridinsoft trust score of 0/100, and is blocked by PhishDestroy, MetaMask, and SEAL. The evidence confirms a high‑risk, active brand‑impersonation operation targeting Bitcoin users. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no page content has been disclosed. Defenders should block the domain at network perimeter, update URL filtering rules, monitor for DNS queries to 104.21.90.50, and consider adding the domain to internal blacklists. Ongoing threat‑intel feeds should be consulted for any emerging indicators of compromise related to this infrastructure.