sol-claim[.]bet

On 23 July 2026, the domain sol-claim.bet was observed targeting the Solana brand through a credential‑harvesting site that presented the page title “Solana”. The domain was registered on 20 March 2026 via PDR Ltd. d/b/a PublicDomainRegistry.com and delegated to the Cloudflare nameservers dane.ns.cloudflare.com and nena.ns.cloudflare.com. DNS resolution points to the IP address 172.67.145.212, which belongs to Cloudflare, Inc. in Canada. The site served a TLS certificate issued by Let’s Encrypt, and traffic was delivered over HTTP/3 with Cloudflare Browser Insights enabled. Automated fingerprinting identified a stack consisting of Node.js, Vue.js, Nuxt.js, and jQuery, confirming a modern JavaScript‑driven front end.

Threat intelligence indicates that the domain has been classified as a crypto‑related scam and that three independent blocklists—PhishDestroy, MetaMask, and SEAL—have already added it to their deny lists. VirusTotal analysis shows that 13 of 94 security vendors returned a positive detection for the domain, reinforcing the malicious assessment. The presence on three blocklists and the multi‑vendor VirusTotal alerts provide a high confidence signal that the domain is engaged in brand impersonation and should be treated as high risk. The domain currently reports an offline status, suggesting that the phishing infrastructure has been taken down or is temporarily inaccessible.

While the available data confirms the presence of a Solana‑impersonating page and the associated technical indicators, no additional content snapshots or login form details have been captured, leaving the exact user‑experience unknown. Defenders should continue to block the domain at network and endpoint layers, monitor for newly registered domains that use the same registrar or Cloudflare name servers, and consider adding the IP address 172.67.145.212 to reputation feeds pending further investigation.