claim[.]legendsofsol[.]com

Analysis of claim.legendsofsol.com shows a high‑risk crypto‑draining operation that remains active as of July 24, 2026. The domain was registered on January 02, 2024 by Instra Corporation Pty Ltd. It resolves to IP address 64.29.17.3, which is advertised as belonging to AS16509 Amazon.com, Inc. and is geolocated in the United States. HTTP requests to the site return a 302 redirect, suggesting an attempt to forward visitors to a secondary payload or collection endpoint. No TLS certificate is presented, meaning traffic is unencrypted and susceptible to interception. The page title returned by the server is "Legends of SOL CLAIM," aligning with the listed scam type of a crypto scam.

Reputation services provide mixed signals: Gridinsoft assigns a trust score of 0 out of 100, Scamadviser rates the domain at 46 out of 100, and the site appears on a single security blocklist. VirusTotal scans have flagged the domain in three of ninety‑one antivirus engines, indicating detectable malicious components. Cloudflare’s authoritative name servers (igor.ns.cloudflare.com and magdalena.ns.cloudflare.com) are in use, a common choice for fast‑flipping or malicious domains seeking resilience. PhishDestroy has already blocked the domain, confirming that at least one defensive network considers it malicious.

The combination of a recent registration, low trust scores, lack of SSL, redirection behavior, and multi‑engine detection strongly points to a crypto‑drainer campaign targeting users who may be lured by promises related to Solana or other blockchain assets. Uncertainty remains regarding the exact payload delivered after the redirect and whether any additional infrastructure (e.g., command‑and‑control hosts) is linked to the same IP. Defenders should add the domain and its resolving IP to blocklists, enforce HTTPS‑only policies to prevent accidental loading, monitor outbound connections from internal hosts for traffic to 64.29.17.