seekersolana[.]xyz

On 23 July 2026, the domain seekersolana.xyz was identified as a high‑risk brand‑impersonation site targeting Solana users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare name servers casey.ns.cloudflare.com and shubhi.ns.cloudflare.com. No TLS certificate is present, indicating the site was served over HTTP only before being taken offline.

Threat intelligence flags the domain on three independent security blocklists and records explicit blocklisting by PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. A Gridinsoft trust score of 0 / 100 further confirms a lack of legitimacy. VirusTotal analysis reports that 13 of 95 security vendors have flagged the domain, consistent with its designation as a crypto‑scam. The page title returned by the server is the literal string “seekersolana.xyz/”, and no additional content has been captured; the exact landing page structure and any credential‑phishing elements remain unknown.

The site is currently offline, but the infrastructure components (registrar, hosting, name servers) remain publicly observable and could be reused for future campaigns. Defenders should continue to block the domain at perimeter defenses, add the associated IP address 188.114.97.3 to deny‑list entries, and monitor for any re‑registration attempts or similar domains employing the same registrar or Cloudflare name servers. Organizations should also audit wallet‑related authentication flows for any compromise attempts that could be linked to this domain. Ongoing correlation with the listed blocklists and vendor detections is recommended to ensure rapid containment of any resurgence.