solidity-compiler-v1-8-4[.]web[.]app

The domain solidity-compiler-v1-8-4.web.app is currently active and confirmed to host a crypto drainer phishing campaign. This site impersonates the Solidity compiler, a critical tool for Ethereum Virtual Machine (EVM) and ERC-20 smart contract developers. The page title, 'Solidity Compiler - Smart-Contract Compiler for EVM & ERC-20 Developers,' is designed to deceive developers into interacting with malicious smart contracts or disclosing private keys, leading to unauthorized asset transfers. Analysis indicates the domain was registered on June 14, 2026, through Google LLC, a legitimate registrar often exploited for hosting malicious content under its web.app subdomain service. The domain resolves to the IP address 199.36.158.100, a host associated with prior phishing activity. Security vendors have flagged this domain, with 2 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on three security blocklists, including high-confidence threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WR4), provides a false sense of security, as it is automatically provisioned for all web.app domains. As of the latest verification, the phishing site remains active and continues to pose a significant risk to developers and cryptocurrency users. It is strongly recommended to block the domain and its associated IP address at the network level. Users should verify the authenticity of any Solidity compiler tools by accessing them exclusively through official repositories or verified documentation. Organizations are advised to update their threat intelligence feeds to include this domain and monitor for related indicators of compromise, such as wallet addresses or contract interactions linked to this campaign.