solana-safe-wallet[.]com

Analysis of solana-safe-wallet.com indicates a high‑risk brand impersonation campaign targeting Ethereum users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its DNS is served by harlan.ns.cloudflare.com and megan.ns.cloudflare.com. Infrastructure analysis shows the site resolves to IP address 172.67.191.140, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The server presents a valid SSL certificate issued by Google Trust Services under the WE1 certificate authority, and HTTP requests return a 200 status code over HTTP/3, suggesting a fully functional web service.

The page title observed in the response is "솔라나 안전 지갑 - SOL 지갑 생성 및 잔고 조회 | 2026," confirming the site advertises a Solana wallet creation and balance lookup service, yet the listed scam type is Wallet/Seed Phishing. This aligns with the brand‑impersonation objective, as the domain claims to represent Ethereum‑related services despite its Solana‑focused title. Threat intelligence scores are extremely low, with a Gridinsoft trust score of 0 out of 100, and the domain appears on three security blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that major anti‑phishing tools have flagged it.

VirusTotal scans report that one of ninety‑five security vendors flagged the domain, providing additional confirmation of malicious intent. However, detailed malware analysis or payload information is not presently available, leaving the exact phishing kit or delivery mechanisms uncertain. Defenders should prioritize blocking the domain at network perimeter and DNS layers, enforce strict URL filtering, and monitor for any credential or seed phrase submissions that reference this host. Continuous re‑evaluation is advised, as further detection signatures may emerge from additional scanning engines or threat‑intel feeds.