sol-core[.]net

The domain sol-core.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is presently hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.164.213 located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint despite the malicious intent. DNS resolution uses the Cloudflare nameservers elle.ns.cloudflare.com and gerald.ns.cloudflare.com, and the web server returns an HTTP 403 status, which is commonly observed in sites that serve challenge pages or block direct access. The page title returned is the generic string "Just a moment...", offering no direct insight into the page content.

Security telemetry shows the domain is listed on the PhishDestroy blocklist, and VirusTotal reports that five of ninety-three scanning engines have flagged the domain as malicious. Additional analysis from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the suspicion of abuse. The domain is classified as a crypto scam and explicitly impersonates the Solana brand, aligning with the reported brand target.

While the available data confirms the infrastructure, registration details, and detection indicators, the exact payload, phishing page layout, or credential‑stealing mechanisms remain unobserved, as the site currently returns only a 403 response. Defenders should treat sol-core.net as a high‑risk indicator: add the domain to outbound and inbound URL filtering rules, ensure it is blocked in DNS sinkhole configurations, and share the indicator with threat‑intelligence platforms. Continuous monitoring of the IP address and any changes to the HTTP response or page content is advised, as the threat actor may later deploy a full‑scale impersonation page targeting Solana users.