Chipmixer phishing site chipmixer.xyz is showing no-1 position on google search

[sujonali1819]

As always hackers always try to make a clone (phishing) of the most famous sites to steal people's money. One of them chip mixer. As always I search the word chipmixer on google to see the result of the search (so that I can warn people here). So I did it today also. But the result was not good enough. A domain with .xyz is showing on the top of the google page.

Domain link:

Code:

chipmixer. xyz

Domain info: and Site screenshot:





Conclusion :

Those who have browser extensions for crypto security checks could get a phishing alert. But those who don't have this can see the front view without any alert. So always be aware of it and try to confirm the domain is correct.

[1714992243]

1714992243

[1714992243]

1714992243

[1714992243]

1714992243

[1714992243]

1714992243

[Charles-Tim]

It would be good if this is reported by many people and by Chipmixer as soon as possible for it to be taken down. I use Google search engine right now and it brought out this fake site:



Unlike google search engine, I used Duckduckgo for it and it brought the correct URL which is Chipmixer.com, but I can see other result too which are fake URLs that belong to scammers.

The other fake URL seen are:

Code:

https://chipmixer.cx/
https://chipmixer.co/
https://www.chipmixer.is/
https://chipmixeres.com/
https://gap.chipmixer.pro/
https://chipmixer.com.mx/
https://xn--chipmixr-70a.com/ (https://chipmixèr.com)
And some others sites like https://darknetone.com/how-to-use-chipmixer-a-complete-guide/

Which URLs are the right clearnet for Chipmixer? I only know of https://chipmixer.com/

The correct URLs:
Tor v3 link: http://chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion/ (chip mix or fly)
Tor v2 link: http://chipmixerwzxtzbw.onion/

Clearnet link: https://chipmixer.com/

[Zwei]

You can use this link to report the url directly to google, https://safebrowsing.google.com/safebrowsing/report_phish/

[coin-investor]

I tried it and its really shows in the first spot for the keyword Chipmixer but if you have metamask and Kaspersky it will be block
looks like it's been reported, I'm sure the phishing site used a lot of money paying SEO companies to rank on that keyword, but it will be eventually busted.

[Lucius]

I also checked what the search engines will show, and in the first place I get a fake page that ends in cx, while in the second place there is a legitimate page. Unfortunately, scammers use various techniques to try to position themselves at the top of the search, and it's not just through ads anymore - because all these phishing sites have nothing to do with that and we see them as normal search results.

I advise everyone to save a legitimate website in their favorites, and also to be aware that mix only works with an onion address, so all sites that offer you mix through clearnet addresses are 100% fake.

Which URLs are the right clearnet for Chipmixer? I only know of https://chipmixer.com/

The correct URLs:
Tor v3 link: http://chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion/ (chip mix or fly)
Tor v2 link: http://chipmixerwzxtzbw.onion/

Clearnet link: https://chipmixer.com/

The TorV2 link you provided does not work, and the only real addresses are found in each CM signature, although everything should be checked considering the possibility that someone's profile can be hacked and the links changed. See here -> https://bitcointalk.org/index.php?topic=1935098.0

[Little Mouse]

ChipMixer clearnet is down for a long time now, I can't remember exactly since when it's down but if I'm correct it should be at least a few months and since Tornado Cash developer got arrested(not sure if both are correlated lol). Scammers are using that opportunity to rank up the fake ones and rip innocent users.

the only real addresses are found in each CM signature, although everything should be checked considering the possibility that someone's profile can be hacked and the links changed. See here -> https://bitcointalk.org/index.php?topic=1935098.0

As they say, it's always better to verify than trust someone. We have everything in the ANN thread. Why would we even blindly trust a signature campaigner?

[Charles-Tim]

The TorV2 link you provided does not work, and the only real addresses are found in each CM signature, although everything should be checked considering the possibility that someone's profile can be hacked and the links changed. See here -> https://bitcointalk.org/index.php?topic=1935098.0

That is true, I have just tried the second link, http://chipmixerwzxtzbw.onion/ and it does not work. The three links that I included in my post are copied directly from the Chipmixer's OP ANN thread.

ChipMixer clearnet is down for a long time now, I can't remember exactly since when it's down but if I'm correct it should be at least a few months and since Tornado Cash developer got arrested(not sure if both are correlated lol). Scammers are using that opportunity to rank up the fake ones and rip innocent users.

If you use the clearnet url, that is stated, that people can only access the site through Tor network.

[virasog]

As always hackers always try to make a clone (phishing) of the most famous sites to steal people's money. One of them chip mixer. As always I search the word chipmixer on google to see the result of the search (so that I can warn people here). So I did it today also. But the result was not good enough. A domain with .xyz is showing on the top of the google page.

Domain link:

Code:

chipmixer. xyz

Another strange thing is that when you search chipmixer, the first search result shows a scam site (.XYZ) and the next few link points to bitcointalk and other review sites. I did not find the real chip mixer site on the first few search results sites by google. That is indeed strange.

Secondly what i notice that usually scams clone sites appear in the ads search, but this time it is showing scam chip mixer not as an ad, but as a real site. How is that possible? Does it mean that the scam site has done a better SEO to be on the top?

[LoyceMobile]

You can use this link to report the url directly to google, https://safebrowsing.google.com/safebrowsing/report_phish/

I did. Several times. Google doesn't care. This was brought up in the ChipMixer thread a few times. Short version: don't use Google.

[robelneo]

You can use this link to report the url directly to google, https://safebrowsing.google.com/safebrowsing/report_phish/

I did. Several times. Google doesn't care. This was brought up in the ChipMixer thread a few times. Short version: don't use Google.

I never used it, Google indexes sites based on the parameters they set up, and their spider is not effective anymore in figuring out if the site is a clone of one, scammers have figured out how to manipulate ranking with the use of scrupulous SEO companies
they just accept payment without verifying if its a clone or not, they promised and guaranteed as long as you get their premium packages, so when it comes to sites that you're using be sure to verify first and bookmark it, or better use WHOIS to check phishing sites usually don't last several months.

[Charles-Tim]

I never used it, Google indexes sites based on the parameters they set up, and their spider is not effective anymore in figuring out if the site is a clone of one, scammers have figured out how to manipulate ranking with the use of scrupulous SEO companies
they just accept payment without verifying if its a clone or not, they promised and guaranteed as long as you get their premium packages, so when it comes to sites that you're using be sure to verify first and bookmark it, or better use WHOIS to check phishing sites usually don't last several months.

The safest way I have known is to check their URL on Bitcointalk, scam site can not stay on bitcoin. I assumed that you know that the site is reputed already.

Whois has been one of the ways I do know scam sites, but I can see some fake URL given its domain name since a year ago or more, example are:

Code:

Domain:chipmixer.cx
Registrar:CentralNic Ltd
Registered On:2021-07-05
Expires On:2023-07-05
Updated On:2022-07-06

Code:

Domain:chipmixer.co
Registrar:NameCheap, Inc.
Registered On:2020-11-29
Expires On:2023-11-29
Updated On:2022-02-24

Code:

Domain:chipmixeres.com
Registrar:GoDaddy.com, LLC
Registered On:2021-10-04
Expires On:2023-10-04
Updated On:2022-10-25

Code:

Domain:chipmixer.com.mx
Registrar:Namecheap, Inc.
Registered On:2021-09-22
Expires On:2023-09-22
Updated On:2022-09-16

There are some that I did not paste the code but registered more than 6, 7, 8 months ago. Truly I have also used Whois to know some scam sites because their domain name were registered just like 1, 2 or 3 months ago, but there are few old ones too.

[khaled0111]

ChipMixer clearnet is down for a long time now, I can't remember exactly since when it's down but if I'm correct it should be at least a few months

Since last May. In fact the domain name and website is not down but you can't use it to mix your coins. It's used to host a static page with a link to.onion page:

.com is now online. It does not allow mixing. It is used for informational purposes only.

Whenever I need to use chipmixer I access it by clicking on the link on the signature of any of the cm sig. campaign participants and make sure the url starts with chip mix or fly.

[Lucius]

I did. Several times. Google doesn't care. This was brought up in the ChipMixer thread a few times. Short version: don't use Google.

I can only say that before the situation was much better in this regard, most reported phishing sites were blocked in just a few days, which meant that most browsers showed a red warning about a dangerous site and blocked access to it. Something has definitely changed in the way Google handles everything that is reported, and it has to do something with mixers.

I think I already wrote it somewhere, but it seems that they don't want to protect people from such things and that in this way they want to create as much pressure as possible on the mixers in terms of their elimination.

[ajiz138]

ChipMixer has been cloned 32 times according to the list compiled by @LeGaulois in this thread. Scams Bitcoin Mixers List and Services closed

So it's not surprising that there are still a number of Chipmixers that are still cloned and active until now. I don't know how they got to position 1 in Google search, even though many have reported it.

One thing you need to know is that sometimes searching on Google is always misleading because phishing sites always appear that are still there.

[Charles-Tim]

So it's not surprising that there are still a number of Chipmixers that are still cloned and active until now. I don't know how they got to position 1 in Google search, even though many have reported it.

That is google, scammers den. It is no more a surprise, especially if the site link are ads, but also there are several cases like this that google will put the fake sites at the top. That is why it is better to use a privacy search engine like Duckduckgo. I used google just now again, the fake site is still at the top, I hope people will not be scammed this way, but the first link is the the correct site on Duckduckgo.

But what that is most important is for us to know the correct URL to use.

[dkbit98]

ChipMixer clearnet is down for a long time now, I can't remember exactly since when it's down but if I'm correct it should be at least a few months and since Tornado Cash developer got arrested(not sure if both are correlated lol). Scammers are using that opportunity to rank up the fake ones and rip innocent users.

It's not down at all, ChipMixer is still using .com domain but it is not being used for mixing but it is redirecting to .onion Tor domain.
I think several forum members was suggesting this solution even before it happened to reduce and avoid risks of clearnet domain getting hijacked again.
We also noticed phishing domains like .xyz and others are on top of search engines but that is unrelated with official .com domain.

[Lucius]

That is why it is better to use a privacy search engine like Duckduckgo. I used google just now again, the fake site is still at the top, I hope people will not be scammed this way, but the first link is the the correct site on Duckduckgo.

The search results do not necessarily have to be the same for everyone, and I think that they primarily depend on geolocation. For example, as the first search result with DuckDuckGo I see a phishing site (cx), while with Google I also see a phishing site (xyz). It's the same with paid ads that you can see if you don't have adblock installed and turned on, because scammers target certain countries more than others.

[Little Mouse]

It's not down at all, ChipMixer is still using .com domain but it is not being used for mixing but it is redirecting to .onion Tor domain.
I think several forum members was suggesting this solution even before it happened to reduce and avoid risks of clearnet domain getting hijacked again.

I have forgotten what happened but was sure that something happened lol and I thought they were down, haven't checked in a recent time. Did their clearnet domain get hijacked? I can't remember if I have heard about that.

I think that they primarily depend on geolocation. For example, as the first search result with DuckDuckGo I see a phishing site (cx), while with Google I also see a phishing site (xyz). It's the same with paid ads that you can see if you don't have adblock installed and turned on, because scammers target certain countries more than others.

Geolocation is a factor in search engine but most of the time they aren't and it depends on the optimization. Regarding what you said about Google and Duckduckgo, it's because of their robot/crawler. They rank websites based on their own criteria though most of them are similar. Besides, as a domain owner, you must also allow your site to be crawling in different search engines.