solana-claimsaward[.]live

The domain solana-claimsaward.live was observed hosting a page titled “Nur einen Moment…”. The site was flagged by a single vendor on VirusTotal (1/95 detections) and is listed on at least one public blocklist, where it is also marked by PhishDestroy. Infrastructure analysis shows the domain resolves to the IP address 172.67.212.123, which belongs to Cloudflare, Inc. (ASN 13335) and appears to be served from the United States. No TLS certificate is presented, indicating the site was accessed over plain HTTP or that the certificate was omitted at the time of capture. The domain is configured with Cloudflare’s authoritative nameservers ezra.ns.cloudflare.com and jocelyn.ns.cloudflare.com.

Gridinsoft’s trust scoring system assigns a score of 0 out of 100, reinforcing the malicious classification. The domain is explicitly reported to impersonate the Solana brand and is categorized as a crypto‑related scam. The current host status is offline, which may limit immediate interaction but does not remove the threat from threat‑intel feeds. Defenders should continue to block the domain at perimeter filters, DNS resolvers, and proxy appliances.

Because the IP resides within a shared Cloudflare network, additional traffic to the same address may be benign; therefore, rule sets should target the fully qualified domain name rather than the IP alone. Monitoring of any future DNS resolution changes or re‑deployment of the domain is advised, as actors often recycle Cloudflare‑hosted assets. Incident response teams should also review recent logs for any attempted connections to solana-claimsaward.live or its IP, and correlate those events with user‑reported phishing attempts involving the Solana brand. Updating threat‑intelligence platforms with the observed indicators—domain name, IP, nameserver pair, page title, and the single VirusTotal detection—will improve detection across the organization.