email[.]solanadomains[.]com

The domain email.solanadomains.com has been identified as a brand impersonation threat targeting the Solana cryptocurrency ecosystem. Analysis confirms this domain was actively engaged in brand_impersonation, presenting itself as an official Solana service under the page title 'Solana Domains – Premium domains for your Solana Dapp or wallet address.' The domain is currently offline, though its prior activity warrants continued scrutiny. Infrastructure analysis reveals the domain was registered through Automattic Inc. on July 01, 2021, and resolved to the IP address 192.0.78.25. It appears on one security blocklist, and VirusTotal records indicate detection by 1 of 95 security vendors. The SSL certificate was issued by Let's Encrypt (serial number E8), a common but not inherently malicious certificate authority. The domain's creation date predates its malicious use, suggesting potential compromise or repurposing of previously legitimate infrastructure. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, organizations and individuals within the Solana ecosystem should remain vigilant. It is recommended to monitor for resurgence under similar domains, verify SSL certificates against known legitimate Solana services, and block the IP 192.0.78.25 in network security controls. Users who interacted with this domain should audit their wallets and connected applications for unauthorized transactions or data exposure.