elsol-app[.]pages[.]dev

This domain is flagged as a high-risk instance of crypto brand impersonation, specifically targeting Solana users through a fraudulent liquid staking interface. The page title, 'elSOL Liquid Staking for Solana SWQoS,' mimics legitimate Solana-based financial services to deceive victims into interacting with malicious smart contracts or disclosing wallet credentials. Analysis indicates this is a deliberate attempt to exploit trust in decentralized finance (DeFi) platforms, likely functioning as a crypto drainer to siphon assets from connected wallets. Infrastructure analysis reveals the domain elsol-app.pages.dev resolves to the IP address 172.66.47.152 and is registered through Cloudflare, Inc., with a creation date of June 10, 2026. Detection metrics show minimal coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains, which does not inherently indicate trustworthiness in this context. Mitigation steps for this specific threat type include immediate blocking of the domain and IP address within network security controls. Users should be advised to avoid interacting with any Solana-related financial services hosted on non-official domains, particularly those mimicking liquid staking platforms. Wallet providers and DeFi platforms are recommended to implement real-time domain reputation checks to prevent connections to known impersonation sites. Additionally, organizations should monitor for unusual outbound traffic to 172.66.47.152 and investigate any user reports of unexpected asset transfers or unauthorized wallet access.