9 scams were added to the list of mixers to avoid.

The domain names belong to the same person, and he does the same with other mixers

What the scammer does:

- He buys a few domain names similar to some legit mixers.
- He clones their design
- Then it becomes tricky to figure out how the URLs are ranking on the SERP
- He hacks some old websites (with authority), injects texts and backlinks, and spams the web
- He is actually using 13 domain names at the same time. Sometimes he redirects the domain name to another one. I believe when a domain is busted he redirects the URL to get the juice to the new domain. It was a trick to fool google with SEO years ago

Nothing sophisticated per se


All the domains owned by the same scammer:

bitcoin-chipmixer.com <= the domain name is ~2 weeks old (or maybe 1 month, sorry I already forgot)
chip-mixer.net <= redirects to the first
bestmixer.net
coino-mize.com
best-bitcoin-mixer.com
cryptomixer-io.com
coinmixer-es.net
blender-io.net
blenderbitmixer.com
smartmixer.net
bitcoin-laundry.net
my-crypto-mixer.com
bitcoinmixer-io.com
mixtum-io.com

Good find! His original post (I'm not even going to post a link to my archive) used a different phishing URL:

2 new domains were added to the scam list.
The worst thing is that I suspect these domains belong to a mixer currently online and even listed in my original post :/ I don't have any concrete proof (yet) but what I found is quite strange and the possibility of a coincidence, low enough. There is a 3rd domain name involved, so the person operates 3 scams (at least).




Happy new year everyone

I'd say go for it. But keep it in Service Discussion, not Scam Accusations.

All mixers using [banned mixer] look inactive and abandoned. As for mixsafer.com, I noticed they deleted their Facebook page and their Reddit account and it was done not long ago because I was able to see the content via google web cache. But at the same time, they used Twitter last month. They display [banned mixer]'s email on their website to make things on autopilot for the support (i guess). Whatever but the service doesn't seem active for now

This weekend, I tried to email [banned mixer] but it wasn't delivered, look like they deleted their email

Time to remove mixsafer.com

edit:

Bitcoin mixers using [banned mixer] include:
- XXL Mixer
- Bitmixer.online
- Mixer1.money
- Mixtum
- Bitmixer.cash
- [banned mixer]
- Mixsafer.com

While I agree with your view and have the same speech here and there, it's hard to say a mixer isn't a mixer due to its setup. It's like arguing your soup isn't a real soup because you haven't followed the highest standards. At best, we could argue about a blender not using the appropriate methods, but it's up to people to make their own opinion/searches about what's good and what's not

It is about lowering risk, hiding with SSL, the problem is it increases another one. It's not easy to judge the pros and cons to find the right ratio.

And about SSL, I wonder why CF is so prominent (even on the web in general) when there is a multitude of alternatives. CF is really a big fish

(I will edit the OP during the weekend)

I know i'm preaching to the choir here, and i know this is your thread, but i still wanted to chip in to give some more background information since i think this is really, really important stuff...

I've actually dedicated a complete thread to this problem, i like to refer to it since it cost me a long time to write this stuff up: https://bt.irlbtc.com/view/5247838.0

The problem with the soup analogy is the following.
When i eat soup, i have several "mayor" goals and a couple "minor" goals.

• I want nourishment: mayor goal
• I want a healthy snack: mayor goal
• I want something to quench my thirst: minor goal
• I want something warm: minor goal

If mixers using cloudflare had to fit into the soup metaphore, cloudflare mixers would be like calling hot water with salt "soup". When it comes to my goals:

• I want nourishment: mayor goal: FAILED
• I want a healthy snack: mayor goal; FAILED
• I want something to quench my thirst: minor goal: OK
• I want something warm: minor goal: OK

When it comes to mixing, i also have mayor and minor goals... When talking about cloudflare mixers, this is where i stand:

• I want complete anonymity against everybody (including law enforcement): mayor goal: FAILED
• I want "normal" (non hacker/non law enforcement) users not to be able to track me: minor goal: OK

The problem here is that, once a site uses cloudflare's SSL certificates, what happens is:
The mixing client creates a symmetric key between their device and CLOUDFLARE... The user THINKS he's safe because he/she sees a green padlock in the mixer's url, but he does not realise cloudflare WILL decrypt EVERY package they sent to (what they think is) the mixer. Cloudflare then looks at the requests, checks it's cache, and if the request cannot be fetched from the cache, they create a symmetric key between cloudflare and the mixer to request the missing content.

This means that, when a mixer uses cloudflare, cloudflare will know:

• The exact deposit address shown by the mixer
• The exact withdrawal address entered by the client
• The letter of guarantee (if the client downloads it)
• The client's ip
• The client's browser fingerprint
• The exact timestamp

Not only this, but cloudflare is a US company... In the US, data privacy seems to stop as soon as law enforcement comes into play... This basically means that, if you use a mixer using cloudflare, law enforcement *might* be able to obtain more data about you than if they'd had access to your wallets directly.

Now, once again: i'm not against cloudflare... Cloudflare protects even my own blog against DDos attacks, it speeds up my site due to their cache, it lets me enhance my site due to their addons, it handles my emails, it's a really easy dns record editor,.... Cloudflare is great, as long as your visitors don't have anything to hide from a US company (and US law enforcement).

It's great for non-political blogs, it's great for mom and pop shops... This being said: it's not OK to use cloudflare's cache (and their ssl certificates) for a mixer, a gunshop, a political blog, a porn site,...

Any data that gets recorded can get leaked. I'm not sure how secure 3 letter agencies are, but I am sure they can't leak what they don't know.

That doesn't matter: the certificate handles the traffic between the user and Cloudflare, not between Cloudflare and the server. See this post (about Bitcointalk, but it applies to any site that uses Cloudflare):
Or my own (layman) explanation: Cloudflare can only stop DDOS if they know what traffic is coming in. In order to stop only the attack and not all data, Cloudflare has to decrypt everything.