# PhishDestroy domain threat record: raven.sol-streams.cc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/raven.sol-streams.cc/
Machine-readable companion: https://phishdestroy.io/domain/raven.sol-streams.cc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-16 14:23:17 UTC
- Last availability or vendor check: 2026-10-22 10:51:32 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.150.245
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, sol-streams.cc): 2026-10-09 11:33:57 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14522-2385-715d-9c77-767a4b8dc3b9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/raven.sol-streams.cc
- Certificate Transparency search: https://crt.sh/?q=%25.raven.sol-streams.cc
- Web Archive lookup: https://web.archive.org/web/*/https://raven.sol-streams.cc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
raven.sol-streams.cc is a live crypto wallet drainer site first identified by PhishDestroy on 2026-10-16 and confirmed still active as of 2026-10-18. The domain was registered on 2026-10-09, making it less than two weeks old at the time of detection. It presents itself under the brand name RAVEN and appears to target cryptocurrency wallet holders, particularly those on the Solana ecosystem given the sol-streams subdomain structure.

How the scam works
The page title — "RAVEN — The internet is hiding things. Find them." — frames the site as a discovery or intelligence tool, which may be used to lure users curious about hidden or exclusive crypto content. Once a visitor connects their wallet to interact with the platform, the drainer silently requests broad token approvals or crafts transactions that transfer assets directly to attacker-controlled addresses. The victim loses control of tokens and NFTs held in the connected wallet without any clear warning that a malicious action has occurred.

Evidence
PhishDestroy classifies this domain as a crypto drainer and it appears on the PhishDestroy blocklist. Spamhaus DBL flags it under the DBL_SPAM category, providing independent corroboration that the domain is associated with abusive activity. As of 2026-10-16, zero of 92 antivirus engines on VirusTotal had flagged the domain, which is consistent with a freshly registered drainer site that has not yet been widely catalogued by traditional security vendors. Low antivirus coverage does not reduce confidence in the classification; blocklist and Spamhaus signals are strong independent indicators.

Infrastructure
The domain was registered on 2026-10-09 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses Cloudflare, Inc. infrastructure routed through Canada for hosting and DDoS protection. TLS is provided by Let's Encrypt under the YE1 intermediate, a free certificate that requires no identity verification. The combination of a very recently registered domain, privacy-friendly CDN routing, and a free TLS certificate is a common setup for short-lived fraud sites.

What to do
If you visited this site without connecting a wallet, no immediate action is required beyond avoiding any further interaction. If you connected a wallet, immediately revoke all token approvals granted to any contract associated with this site using a trusted approval-management tool, then transfer remaining assets to a freshly generated wallet. If you signed a transaction, assume any assets in that wallet are at risk and act without delay. Security teams and wallet providers should add raven.sol-streams.cc to blocklists and warn users who may have been redirected to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14522-2385-715d-9c77-767a4b8dc3b9/
VirusTotal report: https://www.virustotal.com/gui/domain/raven.sol-streams.cc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=raven.sol-streams.cc
Archived copy: https://web.archive.org/web/20261012194936/https://raven.sol-streams.cc/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-18 21:07:37 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/chgvLXDg/0e18dee69f45.png
  Captured: 2026-10-16 14:35:27 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a14522-2385-715d-9c77-767a4b8dc3b9.png
  Captured: 2026-10-16 14:35:27 UTC
  Source report: https://urlscan.io/result/01a14522-2385-715d-9c77-767a4b8dc3b9/
- URLScan capture 2: https://urlscan.io/screenshots/01a14510-120b-716e-96d2-b5bd6a92732e.png
  Captured: 2026-10-16 14:23:17 UTC
  Source report: https://urlscan.io/result/01a14522-2385-715d-9c77-767a4b8dc3b9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/45b57162-dae6-4c86-b4d7-5036cc10bafd.png
  Captured: 2026-10-16 14:27:23 UTC
  Source report: https://radar.cloudflare.com/scan/45b57162-dae6-4c86-b4d7-5036cc10bafd
  SHA-256: fa2bf34b737fd20e4abcae933f3ecabe31fe698e64ab014dd3c9372c85b6ed42
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1431d-4788-778b-ac62-c2383c2ba596.png
  Captured: 2026-10-16 05:09:24 UTC
  Source report: https://urlscan.io/result/01a1431d-4788-778b-ac62-c2383c2ba596/
  SHA-256: 02838b0f871b9c77b97c2a0a8d1a6de5f49398464487d5338d7e331ace68b648
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14510-120b-716e-96d2-b5bd6a92732e.png
  Captured: 2026-10-16 14:14:11 UTC
  Source report: https://urlscan.io/result/01a14510-120b-716e-96d2-b5bd6a92732e/
  SHA-256: 6446cc81f4deaed29575cec52dc68bbb57fb25a807d8f1f9c3ed9f3113276af8
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1451c-a350-7608-b275-b8b88c554feb.png
  Captured: 2026-10-16 14:28:00 UTC
  Source report: https://urlscan.io/result/01a1451c-a350-7608-b275-b8b88c554feb/
  SHA-256: 92165f56f1ec967f5afcc4b5026401d43e93d06f93776f07c53636a6c8d6f013
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a1488b-d453-7788-bd33-815e68961e4b.png
  Captured: 2026-10-17 06:28:14 UTC
  Source report: https://urlscan.io/result/01a1488b-d453-7788-bd33-815e68961e4b/
  SHA-256: 8d10d656e9a0cc4da1d7a7711d13246b6fc7c00707162d1d57e7a972debf3ab7
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14929-d943-7778-bf1d-c0dbcd2cbc9c.png
  Captured: 2026-10-17 09:20:50 UTC
  Source report: https://urlscan.io/result/01a14929-d943-7778-bf1d-c0dbcd2cbc9c/
  SHA-256: 317b6175d704c51cccbbcc0a2cba4d3831d30635f378b984b6140b992f5887e5

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:45:33Z",
        "uuid": "01a14522-2385-715d-9c77-767a4b8dc3b9",
        "scanned_at": "2026-10-16T14:33:59Z",
        "final_url": "https://raven.sol-streams.cc/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://raven.sol-streams.cc/",
                "from": "http://raven.sol-streams.cc/",
                "status": 307
            }
        ],
        "ip": "2606:4700:3037::6815:7e",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "142.251.222.3",
            "172.67.150.245",
            "2404:6800:4006:801::200a",
            "2606:4700::6810:4f49",
            "2606:4700:3037::6815:7e"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US",
            "AU"
        ],
        "link_domains": [
            "x.com",
            "t.me"
        ],
        "social": [
            "https://x.com/RavenHuntSol",
            "https://t.me"
        ],
        "doc_hash": "ba2e021e0f7e8c3c4fe7f9afefed5bf7e17d33552178899823f9128a0d7b3a2f",
        "script_hashes": [
            "68083819683e678962460088a4ee28bec60aeeaff4dc6f1b8a2ce7f0e234cdd3",
            "093349918b58f905d04a3c1aea621e297f3315162f11d2c7ad647aa3b94ae129",
            "02378e91bd0c35812c627c843580a61cc7db37ea193779c5748e037b07df0fd3",
            "e93db217b5f486ea9ad8375bb851c142d983f35f5877953f096f6161be3aa723",
            "ac1b98a10f751a146e9b7e8d1f0aa9fa7f65142521f3750b88e15d80c1fc4324",
            "c55fa4ff9db1a3edb8c0e8555ca52400d42c2c4f666f16f81f31c8aa6c3d5bea",
            "48569a58febe05bc2ff37e925c819a43e561f67f24abeae1fdc4d606d156f169",
            "d68d044746fa4e8426389a1583530192ebccc06f5708d31182ddad4bc65862c6",
            "a1f8785b80e1181fdba532256a92ae4fe26cfe56b8231dcaa5e0aece8f24c7f3",
            "63169afa8316f235efa81fe970d804fa5ddcb59732d5688345b723aa60556573"
        ],
        "globals": [
            "RAVEN_CONFIG",
            "RAVEN",
            "dataLayer",
            "_vlwi",
            "litPropertyMetadata",
            "reactiveElementVersions",
            "litHtmlVersions",
            "litElementVersions",
            "__cfBeacon"
        ],
        "storage_keys": [
            "raven.state.v1",
            "_0x12",
            "_0x5"
        ],
        "tls": {
            "san": [
                "*.sol-streams.cc",
                "sol-streams.cc"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "sol-streams.cc",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-07T10:37:47Z",
            "valid_from": "2026-10-09T10:37:48Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 4,
        "tls_age_days": 7,
        "tls_valid_days": 89,
        "requests": 28,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:58:48Z",
        "uuid": "45b57162-dae6-4c86-b4d7-5036cc10bafd",
        "scanned_at": "2026-10-16T14:27:23Z",
        "final_url": "https://raven.sol-streams.cc/",
        "status": 200,
        "history": [
            {
                "url": "https://raven.sol-streams.cc/",
                "status": 200
            }
        ],
        "dom_hash": "7f1f0ffb872ab33c70b6293380e685ad7021af57ecbede19f56bf27f3b4222e4",
        "doc_hash": "ba2e021e0f7e8c3c4fe7f9afefed5bf7e17d33552178899823f9128a0d7b3a2f",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "raven.sol-streams.cc",
                "type": "A",
                "value": "104.21.0.126"
            },
            {
                "name": "raven.sol-streams.cc",
                "type": "A",
                "value": "172.67.150.245"
            },
            {
                "name": "raven.sol-streams.cc",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:96f5"
            },
            {
                "name": "raven.sol-streams.cc",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:7e"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.0.126",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-09T11:33:57Z",
            "updated": "2026-10-09T11:33:58Z",
            "expires": "2027-10-09T11:33:57Z",
            "nameservers": [
                "elle.ns.cloudflare.com",
                "gerald.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:44:46Z",
        "analysis_at": "2026-10-20T02:00:09Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 11,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Spam (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-09T11:33:58Z",
        "expires": "2027-10-09T11:33:57Z",
        "updated": "2026-10-09T11:33:58Z",
        "first_seen": "2026-10-16T14:23:07Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.0.126"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:7e"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:96f5"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.150.245"
            }
        ],
        "dns_at": "2026-10-20T02:00:21Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.sol-streams.cc",
                "sol-streams.cc"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6e518aa41384b067a6fb15402e0b4ff3eb3",
            "sha256": "7bff91e0cbbdbaeca9d183c6464538e4c7b76d7201ed385a3459f27517feaac9",
            "subject": "sol-streams.cc",
            "valid_to": "2027-01-07T10:37:47Z",
            "valid_from": "2026-10-09T10:37:48Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-09T11:33:57Z",
            "updated": "2026-10-09T11:33:58Z",
            "expires": "2027-10-09T11:33:57Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "elle.ns.cloudflare.com",
                "gerald.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```