unlockevent[.]live

This domain, unlockevent.live, is identified as a brand impersonation phishing site targeting Solana, a prominent blockchain platform. The site was designed to deceive users into believing it was an official Solana event or unlock portal, potentially facilitating unauthorized access to cryptocurrency wallets or sensitive credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical threat analysis. Analysis indicates the domain was registered on January 21, 2026, through Global Domain Group LLC. It resolved to the IP address 104.21.69.189 and utilized an SSL certificate issued by Google Trust Services, a common tactic to appear legitimate. VirusTotal records show that 2 out of 95 security vendors flagged the domain as malicious, while it appeared on three independent security blocklists. The Gridinsoft trust score for this domain was 0 out of 100, further corroborating its malicious classification. Infrastructure analysis reveals the use of Node.js, Vue.js, and Nuxt.js frameworks, alongside Cloudflare services, including Browser Insights and HTTP/3, which are frequently leveraged to obfuscate malicious activity and enhance performance. The domain is currently offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant, as similar domains may emerge using comparable tactics. It is recommended to monitor for newly registered domains impersonating Solana or related blockchain entities, particularly those using event-themed nomenclature. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with the site should verify wallet security, revoke any suspicious permissions, and report the incident to relevant security teams for further investigation.