solaks[.]top

This domain is under investigation for brand impersonation phishing, specifically targeting Solana ecosystem users through fraudulent yield farming offers. The threat type involves deceptive web pages mimicking legitimate cryptocurrency platforms to harvest credentials or private keys. Analysis indicates a high-risk profile pending further validation, with current evidence suggesting targeted financial fraud operations. Infrastructure analysis reveals the domain was registered on April 18, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with newly created suspicious domains. It resolves to IP address 27.124.47.24 and currently holds a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and is blocked by PhishDestroy, though VirusTotal reports 0/95 detections at the time of assessment. The SSL certificate is issued by Let's Encrypt, and the server runs Nginx with HSTS enabled. The page title, 'TokenPocket | Solana Yield Farming,' directly impersonates the TokenPocket wallet brand while promoting fraudulent Solana investment opportunities. Mitigation steps for this threat type include immediate blacklisting of the domain and IP address across security gateways and endpoint protection systems. Network administrators should monitor for connections to 27.124.47.24 and inspect TLS traffic for Let's Encrypt certificates associated with this domain. Cryptocurrency users should be alerted to verify platform authenticity before interacting with yield farming or staking offers, particularly those promoted via unsolicited links. Security teams are advised to review logs for access to www.solaks.top and correlate with any credential compromise or wallet drain events. Given the domain's current offline status, continuous monitoring for reactivation is recommended.