vmi2931050[.]contaboserver[.]net

This domain is flagged for elevated risk due to brand_impersonation, specifically targeting Solana’s Solscan Analytics platform. The threat involves presenting a fraudulent interface under the page title 'Dashboard DLLM - Solscan Analytics,' likely designed to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. Analysis indicates the domain is actively used for cryptocurrency-related fraud, a common vector for draining wallets or harvesting private keys. Infrastructure analysis reveals the domain vmi2931050.contaboserver.net was registered through RegistryGate GmbH on March 05, 2017, though its malicious use appears more recent. It resolves to the IP address 80.190.83.206 and is currently offline, though prior activity is well-documented. The domain holds a Gridinsoft trust score of 0/100 and is listed on three security blocklists, including MetaMask, SEAL, and PhishDestroy. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, further corroborating its fraudulent nature. Mitigation steps for this brand_impersonation threat include immediate blacklisting of the domain and its associated IP (80.190.83.206) across all network security controls. Organizations should deploy DNS-based filtering to block resolution attempts and monitor for any residual connections to the IP. End-users should be educated to verify the authenticity of Solana-related platforms by cross-referencing official domains and enabling multi-factor authentication for wallet access. Given the domain’s history, security teams should also investigate potential lateral movement or credential reuse tied to this infrastructure.