sol-cleaner[.]click

sol-cleaner.click entered the PhishDestroy evidence set on Mar 31, 2026. Stored content metadata identifies MetaMask as the apparent target. Content analysis also recorded brand signals for Jito. The stored content classification is brand impersonation. The assembled evidence scores 80/100 (high).

Three independent sources are positive: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 7 detections among 94 engines: alphaMountain.ai, CRDF, CyRadar, Fortinet, G-Data, Seclookup, SOCRadar on Mar 31, 2026 at 16:44 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories malware and security threats; its verdict timestamp was not retained. URLQuery recorded 2 detections. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. On Mar 31, 2026 at 16:44 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0).

Cloaking was recorded with HTTP 502 on Aug 7, 2026 at 01:24 UTC. Registration records for the domain list WEBCC as the registrar and Dec 2, 2025 as the creation date. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “Black Background”. DOM analysis completed on Jul 29, 2026 at 04:02 UTC; stored DOM score 78/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:19 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services as the certificate issuer; checked Jun 17, 2026 at 22:00 UTC.

Taken together, the page content and independent findings support classifying this hostname as MetaMask-themed brand impersonation.