chiulemixer[.]space

chiulemixer.space poses a significant threat to Solana users by impersonating the brand in a wallet_connect_phish scheme. The site, which was hosted on an IP managed by Amazon.com, Inc., has been taken down, but it initially managed to evade detection by most security vendors. As of the latest check, only 3 out of 95 VirusTotal vendors flagged it as malicious, highlighting the site's brief but potent operational window.

The domain was registered through NameCheap, Inc., and featured a page title 'CHIULE MIXER - Solana Privacy Mixer,' misleading users into believing it was a legitimate Solana service. The scam exploited the popularity of Solana and integrated recognizable brands like Twitter to enhance its credibility. The absence of an SSL certificate suggests a lack of legitimate security measures, which is typical of phishing domains.

PhishDestroy's early detection of chiulemixer.space on October 18, 2025, underscores the importance of proactive threat intelligence. Despite its offline status, the domain's initial ability to bypass most security checks demonstrates the rapid evolution and sophistication of phishing tactics. The domain's presence on public blocklists, including PhishDestroy's, reflects its recognized threat level. This case exemplifies the critical need for continuous monitoring and swift response to emerging phishing threats.