web-solchainfix[.]pages[.]dev

PhishDestroy identifies web-solchainfix.pages.dev as an active crypto drainer phishing domain designed to steal cryptocurrency assets from unsuspecting users. This domain leverages deceptive branding (Solana/Chainfix) to impersonate legitimate services, tricking victims into connecting wallets or entering private keys. The infrastructure is built on a Cloudflare Pages deployment, exploiting the platform’s legitimacy to evade detection while hosting malicious JavaScript payloads for wallet drainer operations.

Technical indicators confirm this domain as a high-risk threat. VirusTotal reports a detection score of 12/95 security vendors (12.6% coverage), while Google Safe Browsing classifies it as an active phishing domain. The domain resolves to IP 188.114.96.3 (Cloudflare ASN) and is registered through Cloudflare, Inc., with creation timing aligning with recent phishing campaigns. This aligns with a growing trend of crypto drainer phishing sites abusing reputable hosting/CDN services to bypass traditional security controls.

This domain remains active as of the latest analysis, with Cloudflare’s infrastructure complicating takedown efforts. Immediate user action includes avoiding the domain and checking connected wallets for unauthorized transactions. Security teams should block the IP (188.114.96.3) and domain at network/firewall levels. Remaining risk is high due to the drainer’s active status, with potential for further abuse of Cloudflare’s ecosystem. Users are advised to verify URLs via reputable threat databases and avoid interacting with unsolicited crypto-related links.