sollayer[.]xyz

This domain, sollayer.xyz, is actively flagged as a crypto drainer phishing site designed to siphon cryptocurrency assets from unsuspecting users. Analysis confirms the domain remains operational, posing an immediate financial threat to visitors who connect wallets or input sensitive credentials. The infrastructure is specifically engineered to exploit decentralized finance (DeFi) and wallet integration protocols, a hallmark of crypto drainer operations. Infrastructure analysis reveals the domain was registered on May 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 172.67.140.133, a Cloudflare proxy endpoint that obscures the true hosting origin. VirusTotal detection metrics show 11 of 95 security vendors flagging the domain as malicious, with additional blocklist entries across threat intelligence platforms. The SSL certificate, issued by Let’s Encrypt, provides baseline encryption but does not mitigate the underlying threat. Creation date anomalies and proxy usage further corroborate the domain’s fraudulent intent. The domain remains active as of the latest verification, with no evidence of takedown or remediation. Users are strongly advised to block access to sollayer.xyz at the network level and revoke any connected wallet permissions immediately. Organizations should update endpoint protection rules to include this domain and its associated IP in deny lists. Cryptocurrency holders should verify all transaction prompts independently, as crypto drainers often mimic legitimate DeFi interfaces to deceive victims. Continuous monitoring of related infrastructure is recommended to preempt potential pivot domains.