anonymix[.]biz

The domain anonymix.biz is identified as a brand impersonation threat targeting Bitcoin. The domain was designed to deceive users into believing they were accessing a legitimate Bitcoin mixing service, but it was flagged by security vendors and subsequently taken offline. The threat poses an elevated risk due to its impersonation of a well-known cryptocurrency, which can lead to financial losses and data theft.

Analysis indicates that the domain was flagged by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu and resolved to the IP address 172.67.197.110. It was created on November 12, 2024, and used an SSL certificate from Google Trust Services. Additionally, the domain appeared on 3 security blocklists and was mentioned in 2 threat intelligence pulses on AlienVault OTX. The technologies detected include Cloudflare Browser Insights, Cloudflare, and HTTP/3.

The domain is currently offline, indicating that it has been taken down as a response to the identified threat. However, the infrastructure and techniques used by the attackers suggest a continued risk if users have previously engaged with the site. Security measures such as blocking by MetaMask, PhishDestroy, and SEAL have been implemented to protect users. Despite these actions, users are advised to remain vigilant and avoid any links or communications related to anonymix.biz, as similar campaigns may re-emerge using different domains or IP addresses.