sol-helper[.]lol

On 24 July 2026 the domain sol-helper.lol was identified as an active infrastructure supporting a high‑risk brand‑impersonation campaign targeting Solana users. The domain was registered on 21 February 2026 through Global Domain Group LLC and is hosted on Cloudflare nameservers (etienne.ns.cloudflare.com, sneh.ns.cloudflare.com). DNS resolution points to the IP address 77.105.161.122, which belongs to ASN 215428 (Mykyta Skorobohatko) and is geolocated in Germany. The server presents a valid SSL certificate issued by Google Trust Services under the WR2 profile, and HTTP requests return a 200 status code while the page title displayed is “Error 404 (Not Found)!!1”. VirusTotal analysis shows six of ninety‑three security vendors flagging the domain, indicating a moderate detection consensus.

The domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer, and has been referenced in a single AlienVault OTX pulse. The observed scam type is classified as a crypto scam, with the brand target explicitly listed as Solana. No additional content or login pages have been publicly disclosed, so the exact phishing payload remains unknown. The combination of a recent registration, reputable SSL issuance, and a benign HTTP response suggests an attempt to evade automated detection while retaining the ability to serve malicious content if required. The presence on multiple blocklists and the six vendor detections provide sufficient confidence for security teams to treat the domain as malicious.

Defenders should block any network traffic to 77.105.161.122 and add sol-helper.lol to URL filtering rules. Continuous monitoring of the domain’s DNS records and any changes to its hosting configuration is recommended, as the threat actor may later deploy credential‑stealing pages or malicious binaries. Analysts should also correlate any inbound connections from internal hosts to the listed IP with the observed OTX pulse to assess potential compromise.