solanamobile[.]net

The domain solanamobile.net is a phishing site engaged in brand impersonation targeting the cryptocurrency brand Solana. It posed an elevated risk by attempting to deceive users into believing it was affiliated with Solana. The site has been taken offline and is no longer accessible, mitigating immediate threat exposure. No specific drainer kits were identified in this case.

Technical analysis shows that solanamobile.net was created on May 30, 2025, and is registered through Dynadot LLC. It resolves to the IPv6 address 2600:1408:c400:395::1771 located in the United States under AS20940 Akamai International B.V. The domain uses an SSL certificate issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2. VirusTotal flagged solanamobile.net by 1 of 95 security vendors, including SOCRadar. It appears on one security blocklist, PhishDestroy, and employs technologies such as Node.js, Envoy, Express, HSTS, and Akamai. The page title observed was solanamobile.net, and the domain uses nameservers ns1.afternic.com and ns2.afternic.com. Gridinsoft assigned a trust score of 0 out of 100.

Users who encountered solanamobile.net should be aware this is a phishing scam impersonating Solana. They should change any passwords potentially compromised and enable two-factor authentication on affected accounts. Monitoring for fraudulent activity is advised. Since no drainer kit was identified, token approvals revocation may not be necessary, but users should remain vigilant with wallet security. Suspicious activity or encounters with solanamobile.net can be reported to cybersecurity authorities and blocklist providers such as PhishDestroy to aid in mitigation efforts.