atectonic[.]space

This domain, atectonic.space, is actively impersonating Solana as a privacy mixer service, as indicated by its page title 'ATECTONIC - Solana Privacy Mixer.' Infrastructure analysis reveals the domain was registered on March 6, 2026, through NameCheap, Inc., and currently resolves to the IP address 216.198.79.1. The site is flagged by 23 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Additionally, four out of ninety-five security vendors on VirusTotal have detected malicious activity associated with this domain, though the specific nature of these detections remains unverified. The domain employs a Let's Encrypt SSL certificate, which provides basic encryption but does not validate the legitimacy of the site. Its Gridinsoft trust score of 0 out of 100 further corroborates its classification as high-risk. The presence of a known phishing kit, identified as Wallet Connect Abuse, suggests the site is designed to exploit cryptocurrency wallet connections, likely targeting users of the Solana ecosystem. While the exact mechanics of the scam are not yet fully analyzed, the combination of brand impersonation, phishing kit usage, and active threat intelligence reporting confirms malicious intent. Defenders should prioritize blocking access to this domain at the network level, particularly within environments where Solana-related services are utilized. Monitoring for connections to the IP address 216.198.79.1 and correlating logs with Wallet Connect activity may help identify compromised endpoints. Given the domain's persistence since March 2026 and its continued operation as of July 2026, organizations should treat this as an active threat and update detection rules accordingly. Further investigation into the phishing kit's payload and distribution methods is recommended to mitigate potential financial losses or credential theft.