aviir[.]space

Analysis of the domain aviir.space confirms active phishing operations targeting Solana users through brand impersonation. The domain, registered on March 6, 2026, via NameCheap, Inc., resolves to the IP address 216.198.79.1. The page title, 'AVIIR - Solana Privacy Mixer,' explicitly indicates an attempt to mimic Solana’s ecosystem, specifically leveraging the concept of a privacy mixer to deceive users. This aligns with the identified phishing kit, classified as Wallet Connect abuse, suggesting the site is designed to intercept wallet credentials or transaction requests. Infrastructure and threat intelligence data further validate the malicious nature of this domain. It appears in 23 threat intelligence pulses on AlienVault OTX and is blocked by at least two security vendors, including PhishDestroy and BLP-Malware. Additionally, the domain is listed on two security blocklists, and three out of 95 security vendors on VirusTotal have flagged it as malicious. The SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as this is a common tactic to lend superficial legitimacy to phishing sites. The domain remains active as of July 12, 2026, with no indications of takedown or remediation. While the exact content and functionality of the site have not been fully analyzed, the combination of brand impersonation, the use of a known phishing kit, and its presence on multiple threat intelligence platforms confirm its classification as a high-risk domain. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related indicators of compromise, such as the associated IP address 216.198.79.1. Given the domain’s focus on Solana, organizations handling cryptocurrency transactions or wallet services should issue alerts to users about this specific threat. The registration date of March 2026 suggests the campaign has been operational for several months, increasing the likelihood of sustained malicious activity.