vilemixer[.]space

Analysis indicates that the domain vilemixer.space was registered on March 06, 2026 through NameCheap, Inc. and resolves to the Amazon Web Services IP address 216.198.79.193 (AS16509, United States). The site presented an HTTP 200 response and served a TLS certificate issued by Let's Encrypt (R13), confirming active HTTPS service at the time of capture. The page title retrieved was “VileMixer - Solana Privacy Mixer”, directly referencing the Solana brand, which aligns with the intelligence classification of a brand‑impersonation crypto scam. VirusTotal recorded a single positive detection out of ninety‑four scanning engines, confirming that at least one security vendor identified malicious behavior. The domain is currently listed on one external blocklist and has been blocked by PhishDestroy, reinforcing its reputation as a malicious resource.

Nameserver configuration points to dns1.registrar-servers.com and dns2.registrar-servers.com; MX records show an entry for eforward3.registrar-servers.com with priority 10, though the second record is truncated and its full details are unknown. No additional public threat feeds such as OTX or Google Safe Browsing were referenced in the supplied data. The infrastructure suggests a low‑cost hosting posture typical of opportunistic crypto‑related phishing campaigns. Defenders should immediately block DNS resolution for vilemixer.space and its associated IP 216.198.79.193 at network perimeters, enforce TLS inspection to capture any residual HTTPS traffic, and add the domain to internal phishing blocklists.

Monitoring for new subdomains under the same registrar or IP range is advisable, as adversaries often reuse NameCheap registrations and AWS hosting for rapid deployment. Organizations supporting Solana users should raise user awareness about unsolicited mixers and verify URLs against official Solana resources.