mail[.]solana-mixer-tor[.]com

Analysis of mail.solana-mixer-tor.com indicates a high‑risk brand‑impersonation campaign targeting Solana users. The domain was registered on October 12, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.96.3, located in the United States under ASN 13335. Nameservers craig.ns.cloudflare.com and sierra.ns.cloudflare.com confirm the use of Cloudflare infrastructure, while the site lacks an SSL certificate, exposing any transmitted data to interception. The page title, "Solana Mixer | Top SOL Tumbler for Secure and Anonymous Transactions," explicitly advertises a cryptocurrency mixer service, reinforcing the classification as a crypto‑related scam.

VirusTotal recorded 12 detections out of 95 vendor scans, and Google Safe Browsing flags the domain for social engineering, further evidencing malicious intent. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single known blocklist, PhishDestroy, indicating limited but targeted exposure. Current operational status is offline, suggesting the hosting has been taken down or the infrastructure is temporarily unavailable.

Uncertainty remains regarding the exact phishing kit or payload delivered, as no page content beyond the title has been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for related indicators such as the Cloudflare IP 188.114.96.3 and the associated nameservers. Analysts are advised to incorporate the registration details and detection counts into threat‑intel feeds to support cross‑campaign correlation and to watch for re‑registration attempts that may reuse the same brand‑impersonation tactics.