getsolsafe[.]com

PhishDestroy identifies getsolsafe.com as an active brand impersonation domain targeting Solana, delivered through a sophisticated crypto drainer lure disguised as tax loss harvesting. The domain leverages Solana’s branding to deceive users into connecting wallets under the false promise of refunds from 'rug pulls,' a common tactic in cryptocurrency scams where threat actors exploit trust in established blockchain ecosystems. Despite its recent creation on January 12, 2026, the domain has already propagated malicious content, indicating a rapidly evolving threat that requires immediate attention from SOC teams and end users.

Technical indicators paint a concerning picture: the domain resolves to IP address 216.198.79.1 and operates under a valid SSL certificate issued by Let's Encrypt, enhancing its credibility. Currently, VirusTotal shows zero detections (0/95 engines) and Google Safe Browsing (GSB) has not flagged it, while the domain was registered through GoDaddy.com, LLC. These factors suggest the threat actor has taken deliberate steps to evade initial detection while maintaining operational security. The absence of detections does not equate to safety—this is a classic case of a 'low-and-slow' campaign designed to slip past automated defenses.

Despite being under investigation, getsolsafe.com remains active and poses a moderate-to-high risk due to its targeted nature and recent deployment. SOC teams should implement immediate blocking measures at the network and DNS levels, leveraging indicators such as the IP, domain, and SSL certificate fingerprints. Users interacting with Solana-related services must exercise extreme caution, verifying all URLs through official channels before any wallet connections. While the current threat is contained within a 'under_investigation' status, proactive threat hunting and threat intelligence sharing are critical to prevent broader exploitation. Remaining risk hinges on how quickly detection mechanisms adapt to this novel campaign.