# PhishDestroy threat dossier — dapp.solwpa.com ================================================================ Fetched: 2026-07-26 14:48:58 UTC Canonical: https://phishdestroy.io/domain/dapp.solwpa.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Solana ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 27.124.47.47 (HK, Sheung Wan) ASN: AS152194 CTG Server Limited Hosting org: Rackip Consultancy Pte. LTD Registrar: Name SRS AB Nameservers: ["a11.share-dns.com", "b11.share-dns.net"] Page title: TokenPocket | Solana Yield Farming HTTP response: 302 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-16 Status: INVALID chain Fingerprint: b2038165fc87f7744049336b3c496ecd3b8aeadf77605c286b76264b353ecb1d Subject Alternative Names (related infrastructure — often same operator): - dapp.solqm.top - dapp.splka.top - solpqy.com - www.solawk.top - www.solpqy.com - www.solqm.top - www.solwpa.com - www.splka.top ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 04:43:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-26 16:20:26 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 04:44:11 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] dapp.solwpa.com credential‑stealing phishing site The domain dapp.solwpa.com has been flagged as a generic phishing infrastructure and remains active as of the report date, July 26, 2026. Registration data shows the domain was created through the registrar Name SRS AB, and its authoritative name servers are a11.share-dns.com and b11.share-dns.net. HTTP probing returns a 302 redirect, indicating that the site is designed to forward visitors, a common technique for credential‑stealing portals. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service, suggesting that at least one sinkhole or filtering platform has identified malicious use. VirusTotal records indicate that the domain was scanned by 91 antivirus and URL‑reputation vendors, with none reporting a detection at the time of analysis; this absence of detections does not imply safety and should be interpreted as a lack of current signatures. No public Safe Browsing, Open Threat Exchange, SSL certificate, IP‑geolocation, trust‑score, page‑title, or evidence‑link data is available, leaving several operational details unknown. Defenders should treat dapp.solwpa.com as a high‑confidence phishing indicator: add the domain to URL filtering and DNS block lists, monitor for any outbound connections to the associated name servers, and enforce credential‑verification controls for users who may encounter credential‑entry pages. Continuous re‑evaluation is recommended, as future scans may produce detections or additional intelligence may emerge. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 8f762dc62659c94c49731c2b150a7f4b TLS cert SHA-256: b2038165fc87f7744049336b3c496ecd3b8aeadf77605c286b76264b353ecb1d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/dapp.solwpa.com/ JSON API: https://api.destroy.tools/v1/check?domain=dapp.solwpa.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 198,198 domains (67,517 alive under monitoring, 129,132 confirmed takedowns/dead). Site: https://phishdestroy.io