# PhishDestroy domain threat record: bullsol.ws Content language: English Canonical HTML report: https://phishdestroy.io/domain/bullsol.ws/ Machine-readable companion: https://phishdestroy.io/domain/bullsol.ws/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-01 20:09:19 UTC - Last availability or vendor check: 2026-10-21 22:32:48 UTC - Stored record updated: 2026-10-22 14:21:24 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 3 - Matching public blocklists: MetaMask, ScamSniffer, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Solana ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registration date (registry RDAP, bullsol.ws): 2026-09-01 06:41:10 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05e96-6564-70de-822c-26d70c147c76/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bullsol.ws - Certificate Transparency search: https://crt.sh/?q=%25.bullsol.ws - Web Archive lookup: https://web.archive.org/web/*/https://bullsol.ws/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bullsol.ws is a phishing page that impersonated Solana under the title "Solana Claim". It targeted Solana users who expect a token claim, airdrop or reward. PhishDestroy first detected it on 2026-09-01. It went offline on 2026-09-11 and was still dead and unreachable when last checked on 2026-10-19. How the scam works A "Solana Claim" page dangles free tokens and asks the visitor to collect them, usually by connecting a wallet. Pages of this type then do one of two things. They push a transaction or signature that hands control of the wallet's tokens to the attacker, or they ask for the recovery phrase under the pretext of verifying eligibility. In either case the claim never pays out, and the victim can lose whatever the wallet holds, often within minutes of approving. Evidence Six of 89 VirusTotal engines flagged the domain as of 2026-09-15: alphaMountain.ai, CRDF, Ermes, Gridinsoft, LevelBlue and SOCRadar. That is a modest count. The stronger signal comes from wallet-focused protection. MetaMask, ScamSniffer and SEAL all list bullsol.ws alongside PhishDestroy, which means wallets and browser extensions relying on those feeds warn users before they connect. The domain also appears in four AlienVault OTX threat pulses, so other researchers tracked it independently. Infrastructure The site was served through Cloudflare, Inc., with the address geolocated to Canada. Because Cloudflare acts as a proxy, that address hides the real origin server. The certificate came from Google Trust Services (WE1), so the padlock in the browser only meant the connection was encrypted, not that the site was genuine. Its active life was short: ten days passed between first detection on 2026-09-01 and going offline on 2026-09-11, a typical lifespan for claim-style lures that are swapped out as they get blocked. What to do If you connected a wallet to bullsol.ws, check your Solana wallet for unfamiliar token delegations or approvals and revoke them, then review recent transactions for anything you did not authorize. If you typed your recovery phrase into the page, treat the wallet as compromised. Create a new wallet with a fresh phrase and move any remaining assets immediately, because revoking approvals cannot protect an exposed seed. Treat any future "claim" link as suspect unless it comes from Solana's official channels. Defenders should block the domain and related claim-themed lookalikes, and add the MetaMask, ScamSniffer and SEAL feeds to their filtering. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05e96-6564-70de-822c-26d70c147c76/ VirusTotal report: https://www.virustotal.com/gui/domain/bullsol.ws Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bullsol.ws Archived copy: https://web.archive.org/web/20260901202649/https://bullsol.ws/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:24:05 UTC ## Stored page captures - Primary capture: https://i.ibb.co/23NVDsBc/a4add3636aab.png Captured: 2026-09-01 20:09:19 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05e96-6564-70de-822c-26d70c147c76.png Captured: 2026-09-01 20:09:19 UTC Source report: https://urlscan.io/result/01a05e96-6564-70de-822c-26d70c147c76/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/75796607-d6df-4e91-8f1e-9e7de190a79e.png Captured: 2026-09-01 20:51:57 UTC Source report: https://radar.cloudflare.com/scan/75796607-d6df-4e91-8f1e-9e7de190a79e SHA-256: a264f1956e268aded835ca64ce5af6f7cac127940758e3481c5cf52d5f2febbc - URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05e81-4265-708b-9b2e-06b44a053cec.png Captured: 2026-09-01 19:45:31 UTC Source report: https://urlscan.io/result/01a05e81-4265-708b-9b2e-06b44a053cec/ SHA-256: e154d832c72f754723ac114be736e412158d2e86377759b4b4a7999d3fb4e822 - URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05e8d-ebf1-77db-8d08-ada18df86493.png Captured: 2026-09-01 19:59:24 UTC Source report: https://urlscan.io/result/01a05e8d-ebf1-77db-8d08-ada18df86493/ SHA-256: e154d832c72f754723ac114be736e412158d2e86377759b4b4a7999d3fb4e822 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:15Z", "uuid": "01a05e96-6564-70de-822c-26d70c147c76", "scanned_at": "2026-09-01T20:08:36Z", "final_url": "https://bullsol.ws/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://bullsol.ws/", "from": "http://bullsol.ws/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "cdn.jsdelivr.net" ], "ips": [ "104.17.207.5", "188.114.97.3" ], "asns": [ "13335" ], "doc_hash": "32f140ba84e4ec9289aac8d234a561ad8a7a25f4016f0fd948f1dfddba0abd5a", "globals": [ "global", "process", "Buffer", "solanaWeb3" ], "tls": { "san": [ "bullsol.ws", "*.bullsol.ws" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "bullsol.ws", "protocol": "TLS 1.3", "valid_to": "2026-11-30T05:57:03Z", "valid_from": "2026-09-01T05:00:38Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 90, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:30Z", "uuid": "75796607-d6df-4e91-8f1e-9e7de190a79e", "scanned_at": "2026-09-01T20:51:57Z", "final_url": "https://bullsol.ws/", "status": 200, "history": [ { "url": "https://bullsol.ws/", "status": 200 } ], "dom_hash": "29657b52c277c6cdf50566d6fc1259ee6970290d13fe03723a9b9ae27bab47dd", "doc_hash": "1fbfea7ec02908619fd496e32c8bc7cf7f87037bbd7a93f2c662b7c5ceb4583f", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bullsol.ws", "type": "A", "value": "188.114.97.0" }, { "name": "bullsol.ws", "type": "A", "value": "188.114.96.0" }, { "name": "bullsol.ws", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "bullsol.ws", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0" } } ```