solanarwa[.]tax

Analysis of solanarwa.tax indicates a high‑risk brand‑impersonation campaign targeting the Solana ecosystem. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and resolves to the IP address 216.198.79.1, which is owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R13), accompanied by HTTP Strict Transport Security (HSTS) headers. Infrastructure fingerprints show the use of Google Cloud services, Vercel hosting, and Google Cloud CDN, while the authoritative nameservers are ns73.domaincontrol.com and ns74.domaincontrol.com.

The page title returned by the server, "SolanaRWA - Track & Manage Tokenized Real World Assets on Solana," aligns with the declared scam type of a crypto scam and explicitly impersonates the Solana brand. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal analysis records a single detection out of 95 scanning vendors, and the domain is listed on at least one security blocklist, with PhishDestroy already marking it as blocked. Although the TLS certificate is valid, the combination of a newly created domain, low trust score, redirection behavior, and brand‑specific page title suggests a deliberate attempt to deceive users seeking legitimate Solana services.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the title has been publicly disclosed. Defenders should immediately block solanarwa.tax at network and endpoint layers, monitor traffic to the associated IP address, and add the domain to URL filtering policies. Continuous re‑evaluation of the IP reputation and periodic VirusTotal rescans are advised to capture any evolving malicious activity.