solana[.]pro-shield[.]sbs

solana.pro-shield.sbs was registered through NameSilo, LLC and first observed on 21 February 2026. The domain resolves to the IPv4 address 23.94.36.139, which belongs to AS36352 operated by HostPapa in the United States. DNS resolution is handled by ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No TLS certificate is presented, so HTTPS connections are not possible. The sole page retrieved before the site was taken offline returned the title “Web3 Infrastructure for Everyone | Solana”, suggesting an attempt to mimic official Solana branding.

The threat profile identifies the campaign as a wallet/seed phishing operation that impersonates the Solana Foundation, a known brand target. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 8 of 93 scanning engines flagged the domain as malicious, confirming a consensus of concern among a subset of vendors. The current offline status indicates that the hosting was likely removed or the site was otherwise disabled after detection.

Open questions remain regarding the specific phishing page layout, any payload delivery mechanisms, and whether additional infrastructure such as command‑and‑control servers were employed. Defenders should add the domain and its associated IP address to internal blocklists, monitor for any future DNS resolution to the same IP range, and consider correlating logs for attempts to resolve or contact the domain. Because the domain uses no SSL, any HTTP traffic can be intercepted, but the lack of a certificate also provides a simple indicator for detection. Continuous watch of the HostPapa AS and the dnsowl name servers for newly registered domains exhibiting similar patterns is recommended to pre‑empt further impersonation attempts.