avyonmix[.]space

avyonmix.space is currently active and hosted on Amazon AWS (AS16509) in the United States, resolving to 216.198.79.1. The domain was registered on 12 August 2025 through NameCheap and uses the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. TLS is supplied by Let’s Encrypt (R13) and the site presents an HTTP 200 response. Automated analysis identifies Vercel and HTTP Strict Transport Security (HSTS) in the technology stack. The page title “AVYON – Solana Privacy Mixer” and the classification as a “Crypto Scam” indicate a deliberate brand‑impersonation of the Solana blockchain ecosystem. The domain is listed on a single security blocklist and has been blocked by PhishDestroy; only one of ninety‑five VirusTotal scanners raised a detection. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. MX records point to eforward3.registrar-servers.com with priority 10, suggesting limited email capability. Open questions include the specific payload or credential‑harvesting mechanisms employed and whether additional infrastructure such as command‑and‑control servers is associated with the site. Defenders should block DNS resolution for avyonmix.space, enforce URL filtering, and monitor outbound traffic to the resolved IP address. Incident response teams should treat any Solana‑related credentials or wallet information submitted to this domain as compromised and advise affected users to rotate keys and revoke any associated tokens.