solamobile[.]xyz

The domain solamobile.xyz has been confirmed as a brand impersonation phishing site targeting Solana, a prominent blockchain platform. Analysis indicates the site was designed to deceive users by mimicking the legitimate Solana Mobile brand, likely to facilitate cryptocurrency-related fraud. The domain is currently offline, but prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered through Dynadot LLC on February 21, 2026, and resolved to the IP address 188.114.96.3. Security vendors on VirusTotal flagged the domain, with 3 out of 95 vendors marking it as malicious. Additionally, the domain appears on two security blocklists, further corroborating its association with phishing activity. The page title, 'Solana Mobile | The Web3 Mobile Evolution,' closely resembles legitimate Solana branding, increasing the likelihood of successful deception. The domain’s current offline status reduces immediate risk, but its prior infrastructure and detection metrics warrant continued monitoring. Organizations and users are advised to block access to solamobile.xyz at the network level and update security filters to include this domain in threat intelligence feeds. Individuals who may have interacted with the site should verify their cryptocurrency wallets for unauthorized transactions and consider revoking any connected permissions. Proactive measures, such as domain reputation checks and user education on brand impersonation tactics, are recommended to mitigate similar threats.