solanamixer[.]net

solanamixer.net was registered on 18 September 2024 through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 152.89.61.96, which is announced by AS30860 (Virtual Systems LLC) and geolocated to Ukraine. Authoritative name servers ns13.v-sys.org and ns14.v-sys.org are configured for the zone. No TLS certificate is presented, indicating the site is served over plain HTTP only.

The public page title observed before takedown reads “Solana Mixer - Anonymize Your Solana (SOL) | Low Fee Solana CoinJoin Service”, and the domain is explicitly listed as impersonating the Solana brand, fitting a crypto‑scam profile. As of the report date, the site is taken offline, and its HTTP status cannot be verified. Gridinsoft assigned a trust score of 39 out of 100, reflecting low confidence in the host. VirusTotal scans reported 2 detections out of 95 security vendors, and the domain appears on a single external blocklist.

PhishDestroy has already added the domain to its blocklist, confirming active mitigation. The limited detection footprint suggests a relatively new infrastructure, but the presence of a dedicated hosting provider in Ukraine and the use of a brand‑specific page title indicate a purposeful campaign to lure Solana users into a CoinJoin service that may exfiltrate funds. Defenders should update perimeter defenses to block both the domain and its hosting IP, monitor DNS queries for the listed name servers, and consider adding the IP to reputational blocklists. Because the site is offline, further forensic collection of page content is not possible; continuous observation of any re‑registration attempts or similar domains containing “solana” and “mixer” is recommended to detect potential resurgence.