trivora[.]space

The domain trivora.space is a confirmed phishing site engaged in brand impersonation targeting Solana users. It presents itself as a 'Solana Privacy Mixer' to deceive victims into connecting wallets via wallet_connect_phish tactics, though no active drainer kit was observed. As of the latest verification, trivora.space has been taken offline, but it remains a documented threat for those who may have interacted with it prior to its removal.

Technical indicators confirm trivora.space as malicious. The domain was flagged by 3 of 95 VirusTotal security vendors, including ADMINUSLabs, alphaMountain.ai, and Fortinet. It appears on 1 security blocklist (PhishDestroy) and was registered through NameCheap, Inc. on June 18, 2025. The site resolved to IP address 216.198.79.193, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US, with no SSL certificate issued. Nameservers were dns1.registrar-servers.com and dns2.registrar-servers.com. AlienVault OTX recorded the domain in 1 threat intelligence pulse, and Gridinsoft assigned it a trust score of 0/100.

Users who connected wallets to trivora.space should immediately revoke all token approvals using a tool like Revoke.cash or Etherscan's token approval checker. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Report the domain to Google Safe Browsing, PhishTank, and the impersonated brand (Solana) to aid in takedown efforts. Enable two-factor authentication on all accounts and remain vigilant for follow-up phishing attempts or fraudulent transactions.