pollyonsol[.]live

This domain, pollyonsol.live, is actively flagged as a high-risk crypto scam targeting users of the Solana blockchain. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to a Cloudflare-hosted IP (172.67.210.88) under AS13335, with nameservers igor.ns.cloudflare.com and faye.ns.cloudflare.com. The site returns a 301 HTTP redirect, suggesting it may be funneling traffic to another malicious endpoint, though the final destination remains unconfirmed. Infrastructure analysis reveals standard Cloudflare protections, including HSTS and HTTP/3, which are frequently leveraged by threat actors to obscure backend details and evade takedowns. The page title, 'Polly on Solana,' explicitly references the Solana brand, aligning with the reported scam type of crypto fraud. As of July 12, 2026, the domain appears on four security blocklists, including PhishDestroy, MetaMask, SEAL, and ScamSniffer, indicating broad recognition of its malicious intent. Five of 93 security vendors on VirusTotal have flagged the domain, though the absence of detections from the remaining vendors does not imply safety. The SSL certificate, issued by Google Trust Services (WE1), is valid but provides no inherent trustworthiness, as certificates are routinely obtained for malicious domains. There is no evidence of a specific phishing kit or backend framework in use, and the exact mechanics of the scam—whether it involves token theft, fake airdrops, or wallet-draining scripts—remain unconfirmed. Defenders should treat this domain as active and high-risk, particularly for users interacting with Solana-related services. Network-level blocking at the IP and domain level is recommended, alongside monitoring for related subdomains or newly registered lookalike domains. Given the domain's recent creation and persistent activity, further infrastructure shifts or rebranding attempts are likely.