sol-helper[.]trade

The domain sol-helper.trade was registered on February 21, 2026 through Global Domain Group LLC and is currently taken offline. DNS resolution points to IP address 170.75.161.159, which belongs to AS174 Cogent Communications, LLC and is geolocated in Canada. The host is served by Nginx and advertises HTTP Strict Transport Security (HSTS) despite the absence of an SSL/TLS certificate, indicating that the site was reachable only over plain HTTP. The authoritative nameservers are sara.ns.cloudflare.com and jeremy.ns.cloudflare.com, both Cloudflare‑managed, a pattern frequently observed in malicious infrastructure.

The page title returned from the site, "SolHelper - AI Analytics for Solana Meme Coins," explicitly references Solana, and the domain is classified as a crypto‑scam that impersonates the Solana brand. Gridinsoft assigns a trust score of 0 out of 100, confirming a lack of credibility. Multiple security products have flagged the domain: fifteen of ninety‑three VirusTotal scanners reported it as malicious, and four independent blocklists (PhishDestroy, MetaMask, ScamSniffer, SEAL) have listed it. The site lacks a valid SSL certificate, further reducing trustworthiness.

While the exact payload or phishing page content has not been disclosed, the combination of brand impersonation, crypto‑scam labeling, low trust score, and broad vendor detection suggests a high‑risk threat aimed at deceiving Solana users. Defenders should block the domain at network perimeter, monitor for DNS queries to the associated IP and nameservers, and update endpoint detection rules to include the observed indicators. Continuous re‑evaluation is advised in case the domain is re‑activated or similar impersonation campaigns emerge.