sol-incinerator[.]app

sol-incinerator.app was registered through Porkbun LLC on March 12, 2026. The domain is currently flagged as active and has a Gridinsoft trust score of 0/100. It appears on three security blocklists and has been blocked by PhishDestroy, MetaMask and SEAL. The site presents itself as “Sol Incinerator – Claim SOL from Vacant Accounts | Burn Tokens”, directly impersonating the Solana brand to lure cryptocurrency holders.

Infrastructure analysis shows the domain resolves to the IP address 172.67.165.138, which belongs to the AS13335 network operated by a major CDN provider. The authoritative nameservers are fish.ns.cloudflare.com and jacob.ns.cloudflare.com. The site serves HTTP status 200 over HTTP/3, uses TLS certificates issued by Let’s Encrypt (identifier E8), and reports Cloudflare Browser Insights as a detected technology.

VirusTotal scans indicate that seven of ninety‑five security vendors flag the domain as malicious, reinforcing the high‑risk assessment. The page content advertises a token‑burn mechanism that pretends to claim SOL from “vacant accounts”, a classic cryptocurrency impersonation technique. The combination of brand impersonation, a fraudulent token‑burn claim, and the presence on multiple blocklists confirms a coordinated cryptocurrency scam targeting Solana users.

Uncertainties remain regarding the full extent of the phishing infrastructure, such as whether additional IP addresses or hosting services will be employed in future iterations. Defenders should proactively block the domain and its associated IP, update intrusion detection signatures to include the observed nameservers and TLS fingerprint, and educate end users about the false “SOL claim” narrative. Continuous monitoring of VirusTotal, blocklist feeds, and any changes to the page title or content is recommended to mitigate ongoing risk.