solwalletbuyer[.]shop

Analysis of solwalletbuyer.shop confirms it as an active phishing domain impersonating Jupiter, a known Solana ecosystem brand, with infrastructure designed to deceive users into interacting with a crypto wallet drainer. The domain was registered on November 9, 2025, through Web Commerce Communications Limited and remains operational as of July 12, 2026. It resolves to IP address 188.114.97.3, a Cloudflare-hosted endpoint, and employs HTTP/3 alongside JivoChat for interactive user engagement—common tactics in phishing campaigns to simulate legitimacy and prompt real-time victim interaction. The site presents itself as a 'Solana Wallet Scanner,' a title consistent with fraudulent schemes aimed at tricking users into connecting their wallets under false pretenses, such as security checks or token airdrops. While the exact content and functionality of the site have not been directly analysed, the combination of the page title, declared brand impersonation of Jupiter, and the use of Cloudflare to obscure hosting details strongly suggests a crypto wallet drainer operation. Security vendors have flagged the domain with high confidence: 13 of 95 engines on VirusTotal detect malicious activity, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX records the domain in 23 threat intelligence pulses, indicating widespread recognition within the security community as a confirmed threat. The Gridinsoft trust score of 1/100 further corroborates its malicious nature. Defenders are advised to block the domain and its resolving IP at the network level, update endpoint protection rules, and alert users to avoid interacting with any site claiming to scan or verify Solana wallets. The SSL certificate issued by Google Trust Services does not mitigate the threat, as it is routinely used to lend a false sense of security to phishing sites.