sol-helper[.]live

This domain, sol-helper.live, is flagged as a high-risk brand impersonation threat targeting the Solana blockchain ecosystem. Analysis indicates the site masquerades as an AI-powered analytics platform for Solana meme coins, a tactic commonly employed to lure cryptocurrency users into interacting with malicious smart contracts or wallet-drainer scripts. The page title, 'SolHelper - AI Analytics for Solana Meme Coins,' directly references Solana, a high-value target for phishing due to its widespread adoption in decentralized finance and token trading. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain resolves to IP address 170.75.161.159, hosted on AS174 (Cogent Communications, LLC) in Canada, and was registered through Global Domain Group LLC on February 21, 2026. It lacks an SSL certificate, a red flag for user security, and is detected by 13 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists, including entries from PhishDestroy, MetaMask, ScamSniffer, and SEAL, further corroborating its malicious classification. As of the latest assessment, sol-helper.live has been taken offline, reducing immediate exposure to end users. However, residual risk remains due to potential re-registration or migration to alternative domains. Users who interacted with the site prior to its takedown should revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and report the domain to relevant security teams. Organizations maintaining blocklists are advised to retain this domain in their databases to prevent future exploitation attempts under similar naming conventions.