1. CoinTor and RedMix use the same order ID format and identical order status terminology.
2. Several FAQ entries are highly similar in wording and structure.
3. Both services are hosted with the same provider. Given that this is a niche hosting provider with very limited adoption, this overlap represents a significant red flag.
The website archive did not allow access to all files from CoinTor, which made the investigation more challenging; however, we conducted the research to the best of our ability.
Redmix:
How long does the cleaning take?
Cleaning takes about 4 - 6 hours on average, but it all depends on the number of bitcoins being mixed, as well as the number of requests for bitcoin mixing. The maximum time is around 24 hours.
How do I use Redmix?
Enter your bitcoin/ethereum address (you can provide us with up to two addresses). Send the coins to the address specified on the order page. Wait for the specified time, which can be found in the letter of guarantee file. After the specified time, you will receive clean coins arriving at your destination address.
CoinTor:
How long does the cleaning take?
Cleaning takes about 4 - 6 hours on average, but it all depends on the number of bitcoins being mixed, as well as the number of requests for bitcoin mixing. The maximum time is around 24 hours.
How do I use CoinTor?
Enter your bitcoin address (you have option to give us up to two addresses). Send coins to the address given on the order page. Wait for the given time which can be found on the Letter Of Guarantee file. After the given time you will receive clean coins arrive to your destination address.
Cointor/script.js:
document.addEventListener('click', function(e) {
let menuBtn = document.querySelector('.menu-btn');
let menu = document.querySelector('.menu');
if(e.target.closest('.menu-btn')) {
menuBtn.classList.toggle('active');
menu.classList.toggle('active');
} else if (menu.closest('.active') && !e.target.closest('.menu-row') && menuBtn.closest('.active')) {
menuBtn.classList.remove('active');
menu.classList.remove('active');
}
})
}
Redmix/script.js:
document.addEventListener('click', function(e) {
const menuBtn = document.querySelector('.menu-btn');
const menu = document.querySelector('.menu');
if (menuBtn && menu) {
if (e.target.closest('.menu-btn')) {
menuBtn.classList.toggle('active');
menu.classList.toggle('active');
} else if (
menu.classList.contains('active') &&
!e.target.closest('.menu-row') &&
menuBtn.classList.contains('active')
) {
menuBtn.classList.remove('active');
menu.classList.remove('active');
}
}
});
Cointor has been hosted at 192.124.178.239 (H2nexus LTD)
Redmix is hosted at 144.31.5.50 (H2nexus LTD)
Approximately four months ago, CoinTor allegedly misappropriated a six-figure sum from a client and subsequently removed its website and all contact channels. Although the client did not provide independently verifiable evidence, CoinTor’s sudden disappearance and elimination of all points of contact strongly suggest that the allegation was credible. Based on our research, we believe RedMix is likely to engage in similar conduct. 
