# PhishDestroy domain threat record: sollletwallet.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sollletwallet.com/
Machine-readable companion: https://phishdestroy.io/domain/sollletwallet.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:16:04 UTC
- Last availability or vendor check: 2026-10-27 23:04:21 UTC
- Stored record updated: 2026-10-27 23:24:55 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: phantom

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: TUCOWS.COM, CO.
- Registrar country in stored WHOIS data: KN
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-11-11 21:13:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17917-fa1e-73ff-aa67-1204f402753e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sollletwallet.com
- Certificate Transparency search: https://crt.sh/?q=%25.sollletwallet.com
- Web Archive lookup: https://web.archive.org/web/*/https://sollletwallet.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot, dated 2026-10-26, shows a page titled Sollet Wallet with a header reading Sollet Wallet Solana sol Wallet, a Sign in button and a prominent Restore Existing Wallet button. The page claimed the official Sollet site was offline and told users to import their 24-word seed phrase into another wallet. PhishDestroy listed it for seed phrase theft, first seen 2026-10-26.

How the scam works
The Restore Existing Wallet button and the recovery instructions route visitors toward entering a 24-word seed phrase into an attacker-controlled flow, enabling wallet takeover. The lure targets users who believe their funds are stranded after the original service shut down. This is a seed-phrase harvesting pattern.

Evidence
The captured screenshot shows Sign in and Restore Existing Wallet controls, impersonation warnings, and instructions to enter a 24-word seed phrase. urlscan scored the scan malicious at 92 on 2026-10-26 although its overall verdict was not malicious, Spamhaus showed no listing on 2026-10-26, OTX recorded 4 pulses, MetaMask and SEAL blocklists plus PhishDestroy's internal listing flagged it, and HTTP to HTTPS 307 redirect loops were recorded. VirusTotal did not flag the domain, and Google Safe Browsing did not flag it. Inspected pages set cookies named XSRF-TOKEN and wallet_recovery_system_session, used a Bootstrap-based stack exposing a uidEvent global, loaded Cloudflare, Google Fonts, Google Static and jsDelivr trackers, and recorded one distinct script SHA256 hash (034bcb08f9e9) for pivoting.

Infrastructure
Registered through Tucows Domains Inc. on 2025-11-11 and observed behind Cloudflare with a Cloudflare WAF on 2026-10-26; posture: TLS 1.3 with TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2; Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP absent; SPF and DMARC present with DKIM not recorded; CAA present; DNSSEC unsigned.

What to do
If you entered a seed phrase, treat every wallet derived from it as compromised, move assets to a newly created wallet obtained from a trusted source, and never enter that phrase again. If you provided a password, change it on the genuine service and enable 2FA. Defenders should block sollletwallet.com and alert users who receive links to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17917-fa1e-73ff-aa67-1204f402753e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/452bb5c2-5d3a-4793-ac66-78c4a162c0a8
URLQuery report: https://urlquery.net/report/d61c285e-d5c9-4ef0-b94e-64fb443060fb
Stored capture screenshot: https://urlscan.io/screenshots/01a17917-fa1e-73ff-aa67-1204f402753e.png
Cloudflare Radar screenshot (2026-10-26T16:19:24Z): https://screenshots.phishdestroy.io/cf/452bb5c2-5d3a-4793-ac66-78c4a162c0a8.png
URLScan screenshot (2026-09-02T08:57:53Z): https://screenshots.phishdestroy.io/us/01a06156-b664-744b-9fb4-d5ad0e2f9273.png
URLScan capture report: https://urlscan.io/result/01a06156-b664-744b-9fb4-d5ad0e2f9273/
URLScan screenshot (2026-09-03T07:41:51Z): https://screenshots.phishdestroy.io/us/01a06637-759a-73ff-9bb9-c0563244719d.png
URLScan capture report: https://urlscan.io/result/01a06637-759a-73ff-9bb9-c0563244719d/
URLScan screenshot (2026-09-23T00:54:44Z): https://screenshots.phishdestroy.io/us/01a0cbc1-ed81-737c-aee1-f2a3a01cbaf1.png
URLScan capture report: https://urlscan.io/result/01a0cbc1-ed81-737c-aee1-f2a3a01cbaf1/
URLScan screenshot (2026-10-26T16:21:40Z): https://screenshots.phishdestroy.io/us/01a17904-60ad-736f-9c17-22f0566ca4e8.png
URLScan capture report: https://urlscan.io/result/01a17904-60ad-736f-9c17-22f0566ca4e8/
URLScan screenshot (2026-10-26T16:25:01Z): https://screenshots.phishdestroy.io/us/01a17907-4b6e-721b-8778-8ec1fd32c2bc.png
URLScan capture report: https://urlscan.io/result/01a17907-4b6e-721b-8778-8ec1fd32c2bc/
URLScan screenshot (2026-10-26T16:31:53Z): https://screenshots.phishdestroy.io/us/01a1790c-0c24-757e-b087-95b27439d15c.png
URLScan capture report: https://urlscan.io/result/01a1790c-0c24-757e-b087-95b27439d15c/
VirusTotal report: https://www.virustotal.com/gui/domain/sollletwallet.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sollletwallet.com
Archived copy: https://web.archive.org/web/20261026161950/https://sollletwallet.com/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:14:56 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17917-fa1e-73ff-aa67-1204f402753e.png
  Captured: 2026-10-26 16:44:59 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0cbc1-ed81-737c-aee1-f2a3a01cbaf1.png
  Captured: 2026-10-26 16:16:04 UTC
  Source report: https://urlscan.io/result/01a17917-fa1e-73ff-aa67-1204f402753e/
- URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06156-b664-744b-9fb4-d5ad0e2f9273.png
  Captured: 2026-09-02 08:57:53 UTC
  Source report: https://urlscan.io/result/01a06156-b664-744b-9fb4-d5ad0e2f9273/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176
- URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a06637-759a-73ff-9bb9-c0563244719d.png
  Captured: 2026-09-03 07:41:51 UTC
  Source report: https://urlscan.io/result/01a06637-759a-73ff-9bb9-c0563244719d/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17904-60ad-736f-9c17-22f0566ca4e8.png
  Captured: 2026-10-26 16:21:40 UTC
  Source report: https://urlscan.io/result/01a17904-60ad-736f-9c17-22f0566ca4e8/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17907-4b6e-721b-8778-8ec1fd32c2bc.png
  Captured: 2026-10-26 16:25:01 UTC
  Source report: https://urlscan.io/result/01a17907-4b6e-721b-8778-8ec1fd32c2bc/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790c-0c24-757e-b087-95b27439d15c.png
  Captured: 2026-10-26 16:31:53 UTC
  Source report: https://urlscan.io/result/01a1790c-0c24-757e-b087-95b27439d15c/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/452bb5c2-5d3a-4793-ac66-78c4a162c0a8.png
  Captured: 2026-10-26 16:19:24 UTC
  Source report: https://radar.cloudflare.com/scan/452bb5c2-5d3a-4793-ac66-78c4a162c0a8
  SHA-256: 28eaaa85e01c409e094b4aa8b8e5cdfc829a0b667bb68a2902d626ba475d56e0
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cbc1-ed81-737c-aee1-f2a3a01cbaf1.png
  Captured: 2026-09-23 00:54:44 UTC
  Source report: https://urlscan.io/result/01a0cbc1-ed81-737c-aee1-f2a3a01cbaf1/
  SHA-256: 034bcb08f9e94b1574a0e35fabe5b1bf3ecca14fc4b1c2296f1ffec770895176

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:52:48Z",
        "uuid": "01a17917-fa1e-73ff-aa67-1204f402753e",
        "scanned_at": "2026-10-26T16:43:14Z",
        "final_url": "https://sollletwallet.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://sollletwallet.com/",
                "from": "http://sollletwallet.com/",
                "status": 307
            },
            {
                "to": "http://sollletwallet.com/",
                "from": "https://sollletwallet.com/",
                "status": 307
            },
            {
                "to": "https://sollletwallet.com/",
                "from": "http://sollletwallet.com/",
                "status": 307
            }
        ],
        "ip": "188.114.97.2",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.110.94",
            "104.17.25.14",
            "104.17.208.5",
            "192.178.170.95",
            "188.114.97.2"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.breadedwallet.com"
        ],
        "doc_hash": "cc2b82a8003243a219933177f907b1e14be49ca33a313d567d2d40d857be6b14",
        "globals": [
            "uidEvent",
            "bootstrap"
        ],
        "cookies": [
            "XSRF-TOKEN",
            "wallet_recovery_system_session"
        ],
        "tls": {
            "san": [
                "sollletwallet.com",
                "*.sollletwallet.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "sollletwallet.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-02T09:50:43Z",
            "valid_from": "2026-09-03T08:51:00Z"
        },
        "domain_age_days": 348,
        "apex_age_days": 348,
        "tls_age_days": 53,
        "tls_valid_days": 90,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:24:37Z",
        "uuid": "452bb5c2-5d3a-4793-ac66-78c4a162c0a8",
        "scanned_at": "2026-10-26T16:19:24Z",
        "final_url": "https://sollletwallet.com/",
        "status": 200,
        "history": [
            {
                "url": "https://sollletwallet.com/",
                "status": 200
            }
        ],
        "dom_hash": "09a3af479fedd3b015c6264c38309b460c4096b08c720c6230a9c11d7f29e197",
        "doc_hash": "eab6c3fc2ade8fb06ecb085ec67f52453a78395dfb1c930b09158212762b5ac5",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sollletwallet.com",
                "type": "A",
                "value": "104.21.8.49"
            },
            {
                "name": "sollletwallet.com",
                "type": "A",
                "value": "172.67.130.94"
            },
            {
                "name": "sollletwallet.com",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:831"
            },
            {
                "name": "sollletwallet.com",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:825e"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.8.49",
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2025-11-11T22:13:35Z",
            "updated": "2025-11-11T22:25:12Z",
            "expires": "2026-11-11T22:13:35Z",
            "nameservers": [
                "carlos.ns.cloudflare.com",
                "monroe.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T19:53:16Z",
        "analysis_at": "2026-10-26T17:08:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "created": "2025-11-11T00:00:00Z",
        "updated": "2025-11-11T00:00:00Z",
        "first_seen": "2025-11-11T22:43:17Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "carlos.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "monroe.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.130.94"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:831"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.8.49"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 -all"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=BlsHu6dKMNKRyXRKAY4bvIDIIFmhl1OnGm22BcqF-iY"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "carlos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:825e"
            }
        ],
        "dns_at": "2026-10-26T17:14:15Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "sollletwallet.com",
                "*.sollletwallet.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "5a3e697af8a2ef2a1374666234c1f473",
            "sha256": "2cb68ddab29cdd2376e90aa887f2dc36afa76ea5701382b56ea2911e2aff380f",
            "subject": "sollletwallet.com",
            "valid_to": "2026-12-02T09:50:43Z",
            "valid_from": "2026-09-03T08:51:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "last changed": "2025-11-11T22:30:12Z",
                "registration": "2025-11-11T22:13:35Z",
                "registrar expiration": "2026-11-11T22:13:35Z",
                "last update of RDAP database": "2025-11-11T22:30:12Z"
            },
            "registrar": "TUCOWS.COM, CO.",
            "registrar_iana_id": "69"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:24:55Z",
        "mail_config": {
            "spf": "v=spf1 -all",
            "dmarc": true,
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "sollletwallet.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:19:50Z",
            "first": "2025-11-20T17:50:34Z",
            "changes": 3,
            "days_archived": 4,
            "scans_per_day": 0.01,
            "avg_page_bytes": 4945
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://sollletwallet.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 4
        },
        "social_tags": {
            "ogUrl": "https://sollletwallet.com",
            "title": "Sollet Wallet",
            "ogType": "website",
            "ogImage": "https://sollletwallet.com/logo.png",
            "ogTitle": "Sollet Wallet",
            "keywords": "solllet,sollet wallet, sollet io, sollet login",
            "description": "Sollet was a popular web IO Wallet and asset bridge for the Solana blockchain Sollet prohibited login and extension use phantom to restore sollet wallet",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://www.sollletwallet.com",
            "ogDescription": "Sollet was a popular web IO Wallet and asset bridge for the Solana blockchain Sollet prohibited login and extension use phantom to restore sollet wallet"
        },
        "trackers": {
            "requests": 10,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 22,
                "wait": 191,
                "connect": 13,
                "download": 1
            },
            "response_ms": 229
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 15985,
            "co2_grams": 0.0006,
            "cleaner_than": 62
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.112",
                    "host": "carlos.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.153",
                    "host": "monroe.ns.cloudflare.com"
                }
            ],
            "zone": "sollletwallet.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "XSRF-TOKEN",
                    "same_site": "Lax"
                },
                {
                    "name": "wallet_recovery_system_session",
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "sollletwallet.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "carlos.ns.cloudflare.com",
                "monroe.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"carlos.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415608652, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "google-site-verification=BlsHu6dKMNKRyXRKAY4bvIDIIFmhl1OnGm22BcqF-iY",
                "v=spf1 -all"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://sollletwallet.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.breadedwallet.com/"
            ],
            "external_count": 1,
            "internal_count": 5
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2025-11-11T22:13:35Z",
            "updated": "2025-11-11T22:25:12Z",
            "expires": "2026-11-11T22:13:35Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "carlos.ns.cloudflare.com",
                "monroe.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```