secureofficial[.]world

On 23 July 2026, secureofficial.world was observed as an offline domain that had been registered on 21 February 2026. DNS resolution points the domain to the IP address 172.67.147.208, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a page title of “Solana”, indicating an attempt to impersonate the Solana blockchain brand, and is classified as a crypto‑scam in the supplied intelligence. VirusTotal records show that 12 out of 93 scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed as blocked by the PhishDestroy service.

The SSL certificate identifier is recorded as WE1, confirming the presence of TLS but providing no further validation of legitimacy. The evidence suggests that the infrastructure was deliberately hosted behind Cloudflare’s network, a common tactic for threat actors seeking anonymity and rapid takedown resistance. The recent registration date and the low trust score imply that the domain was created specifically for the campaign rather than being a compromised legitimate site. Because the site is currently offline, active probing is limited to historical DNS and passive threat‑intel feeds.

No additional details about the underlying web content, login forms, or malicious payloads have been disclosed. Defenders should continue to monitor the IP address 172.67.147.208 for any resurgence of activity, enforce blocklists that contain secureofficial.world, and apply brand‑specific detection rules for Solana‑related traffic. Updating endpoint and network security products with the VirusTotal detection count and the Gridinsoft rating can help reduce false negatives. Organizations that hold Solana assets are advised to treat any unsolicited communications referencing this domain as fraudulent and to educate users about the risk of unsolicited crypto‑investment requests.