sol-recovery[.]xyz

sol-recovery.xyz is an active high‑risk site that was registered on February 26 2026 through NameCheap, Inc. The domain resolves to the IPv4 address 216.150.1.1, which belongs to AS16509 Amazon.com, Inc. and is located in the United States. It serves content over HTTPS using a Let’s Encrypt R12 certificate and returns an HTTP 307 redirect on request. The authoritative name servers are ingrid.ns.cloudflare.com and vern.ns.cloudflare.com, while its MX record points to eforward3.registrar-servers.com. The infrastructure exhibits a low trust profile: Gridinsoft assigns a score of 0 out of 100, and the domain appears on two security blocklists. PhishDestroy has already blocked the site, and VirusTotal reports that 2 of 95 scanned security vendors flagged the domain. The site runs a modern web stack identified as Node.js, React, Vercel, Next.js, HSTS and Webpack, indicating a recent deployment likely hosted on a cloud platform. The observed evidence classifies the campaign as a brand‑impersonation targeting Solana users, with the page title “Sol Recovery” reinforcing the cryptocurrency‑drainer motive. No visual or page‑content analysis is available, so the precise phishing vector remains unknown, but the combination of brand targeting, cryptocurrency scam type, and active redirection suggests an attempt to harvest credentials or lure victims into fraudulent transactions. Defenders should treat sol‑recovery.xyz as malicious. Immediate mitigation steps include adding the domain and its resolving IP 216.150.1.1 to network deny lists, configuring DNS‑level blocks, and monitoring for similar domains registered through NameCheap that resolve to Amazon‑owned IP ranges. Continuous observation of traffic to the Cloudflare name servers and the eforward3.registrar‑servers.com mail server may reveal further campaign activity. Because the site’s content has not been captured, additional sandbox analysis is recommended should a sample be obtained.