sol-incinerator[.]pages[.]dev

This domain, sol-incinerator.pages.dev, is flagged as an elevated-risk crypto drainer phishing site designed to siphon cryptocurrency assets from victims' wallets. Analysis indicates the infrastructure was specifically engineered to exploit wallet connections, tricking users into authorizing malicious transactions that transfer funds to attacker-controlled addresses. The threat type is highly targeted, leveraging social engineering tactics to mimic legitimate decentralized applications or token airdrops, with a focus on Solana-based assets given the domain naming convention. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 188.114.97.3 and was registered through Cloudflare, Inc. on April 08, 2026, suggesting a recently deployed attack vector. It appears on three security blocklists and is actively blocked by wallet security providers and browser extensions. VirusTotal reports 1 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 out of 100. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is commonly abused in phishing campaigns to lend a false sense of legitimacy. The page title, 'Suspected phishing site | Cloudflare,' further corroborates the malicious intent, as Cloudflare Pages is frequently exploited for rapid deployment of phishing infrastructure. Mitigation requires immediate action from both end users and security teams. Users who interacted with this domain should revoke all connected wallet authorizations via their wallet settings and transfer assets to a new, secure wallet address. Security teams should block the domain and its resolving IP (188.114.97.3) at the network perimeter, monitor for outbound connections to the IP, and alert users who may have accessed the site. Wallet providers and exchanges should preemptively flag the domain in transaction simulation tools to prevent users from signing malicious transactions. Given the crypto drainer threat type, emphasis should be placed on educating users about the risks of connecting wallets to unverified sites, particularly those promoting airdrops or token mints.