solahwj[.]top

PhishDestroy identifies Solahwj.top as an active brand-impersonation campaign masquerading as a legitimate cryptocurrency platform to deploy a crypto drainer. The domain resolves to IP 27.124.47.25 and was registered on March 23, 2026 through Gname.com Pte. Ltd. using a Let’s Encrypt SSL certificate, indicating low operational friction and plausible deniability. At time of writing, VirusTotal shows 0 detections out of 95 engines, placing this threat below current radar thresholds despite active hosting. This domain represents a credential-theft and fund-draining operation targeting Web3 users. The absence of detections suggests the campaign is either newly launched or deliberately low-volume to evade automated scanning. The registration date coincides with recent spikes in fake “airdrops” and “wallet upgrades,” a common lure vector for drainers. The registrar’s opaque privacy protections and the use of a free certificate further reduce friction for threat actors, enabling rapid domain cycling once abuse is reported. Users who visited Solahwj.top should immediately revoke any connected wallet permissions via tools such as revoke.cash or wallet settings, transfer remaining assets to a newly generated wallet, and scan devices for infostealers. Report the domain to your browser’s safe-browsing program and block it at the network perimeter using the IP 27.124.47.25 and domain name. Enable multi-factor authentication on email and exchange accounts, and avoid clicking links in unsolicited messages claiming to offer “free crypto” or “wallet updates.” Monitor transaction histories and set up alerting for outbound transfers to prevent irreversible losses.