53140[.]tax

Analysis of the domain 53140.tax indicates active brand-impersonation phishing targeting Solana users as of July 12, 2026. The domain resolves to IP address 23.225.199.94 and is registered through Dynadot LLC. Security vendor detection on VirusTotal shows 16 of 95 engines flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on two security blocklists and has been referenced in 23 threat intelligence pulses on AlienVault OTX, suggesting sustained malicious activity. Infrastructure analysis reveals the use of Let's Encrypt for SSL certification and technologies including Bootstrap, Caddy, Swiper, Lodash, jQuery, and HSTS. The page title 'Welcome' provides limited insight into exact content, though the domain is explicitly categorized as brand impersonation targeting Solana. Defenders should treat this domain as high-risk and prioritize blocking at network and endpoint levels, particularly in environments where Solana-related services are accessed. No evidence currently suggests takedown or mitigation, and the domain remains operational. Further investigation into associated IP infrastructure and registrar actions may be warranted to disrupt the campaign.