# PhishDestroy threat dossier — cs2solana.net ================================================================ Fetched: 2026-04-22 20:53:36 UTC Canonical: https://phishdestroy.io/domain/cs2solana.net/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Drainer Targeted brand: Solana Wallet drainer: Solana Drainer ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.213.251.251 (US, Phoenix) ASN: AS22612 Namecheap, Inc. Hosting org: Web-hosting.com Registrar: NAMECHEAP INC Nameservers: dns1.namecheaphosting.com, dns2.namecheaphosting.com Registered: 2025-12-22 Page title: CS2solana HTTP response: 206 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2026-12-22 Status: INVALID chain Fingerprint: 80eb99269eb75f902ed8d69729f01b5a5dc4e18cec246bf473471776f7322136 Subject Alternative Names (related infrastructure — often same operator): - www.cs2solana.net ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-12-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-22 16:50:10 UTC (by PhishDestroy tracker) First reported: 2026-04-22 13:53:37 UTC (abuse notice filed) Last verified: 2026-04-22 23:49:49 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019db572-42f2-701a-af1b-d8c9f0d86e1b/ URLQuery: https://urlquery.net/report/6ed62017-68d2-42e3-a199-0f3bd12952f8 Wayback Machine: https://web.archive.org/web/*/cs2solana.net crt.sh CT logs: https://crt.sh/?q=%25.cs2solana.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=cs2solana.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/cs2solana.net URLhaus: https://urlhaus.abuse.ch/host/cs2solana.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-22 16:52:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies cs2solana.net as an active Solana-branded crypto drainer domain designed to trick users into connecting their wallets and silently approve token transfers that empty funds. The site mimics the legitimate Solana ecosystem landing page and presents a polished, professional interface to lower user suspicion while the drainer kit executes on-chain approvals without visible confirmation. Once a wallet is connected, the drainer can transfer SOL and SPL tokens to attacker-controlled addresses in seconds, often disguising transactions as routine swap or staking operations. This domain was flagged with the unique seed ee06fb and stands out for its critical risk profile despite having zero VirusTotal detections as of the latest scan. The domain cs2solana.net was registered on December 22, 2025, through NAMECHEAP INC and resolves to IP 162.213.251.251. It carries a valid SSL certificate issued by Sectigo Limited, which helps it evade browser warnings and appear legitimate at first glance. The page title “CS2solana” is intentionally similar to the authentic “Solana” branding, exploiting visual and phonetic similarity to deceive users during quick glances or mobile browsing sessions. If you visited cs2solana.net, disconnect your wallet immediately using the “Disconnect” or “Logout” function in your wallet app. Next, revoke any suspicious approvals via a reputable revoke tool such as solana-revoke.com or revoke.cash, scanning specifically for the domain cs2solana.net or the drainer kit identifier ee06fb. Do not reconnect your wallet to any site unless you have independently verified its authenticity on PhishDestroy. Report the domain and any unauthorized transactions to Solana support and your local cybercrime unit, including the transaction hashes and wallet addresses involved. Enable hardware wallet signing for critical transactions and consider using a dedicated “ burner ” wallet with limited funds for public interactions to minimize potential loss. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260422-EA6FB3 Favicon MD5: 18efaeda8e8d75580753db0ea972e064 TLS cert SHA-256: 80eb99269eb75f902ed8d69729f01b5a5dc4e18cec246bf473471776f7322136 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/cs2solana.net/ JSON API: https://api.destroy.tools/v1/check?domain=cs2solana.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io