solaitransfer[.]com

This domain, solaitransfer.com, is assessed as a high-risk crypto drainer phishing site designed to siphon cryptocurrency assets from victims under the guise of a SOL/USDC transfer service. Analysis indicates the infrastructure is specifically engineered to exploit users of decentralized finance (DeFi) platforms, likely through social engineering tactics such as fake transaction prompts or wallet connection requests. The page title, 'sol-usdc,' directly references the targeted assets, reinforcing the domain's intent to deceive users into authorizing malicious transactions that drain their wallets. Infrastructure analysis reveals the domain was registered on May 21, 2026, through ENOM, INC., an unusual future registration date that may indicate an attempt to evade detection or exploit domain registration anomalies. It resolves to the IP address 8.209.226.222 and is hosted on a server running PHP, Vue.js, and Nginx, technologies commonly used to create dynamic, interactive phishing pages. The domain is flagged by 9 out of 95 security vendors on VirusTotal, appears on four security blocklists, and holds a Gridinsoft trust score of 0/100. Additionally, it is blocked by multiple security layers, including browser-based protections and wallet security extensions, and is categorized under Google Safe Browsing's 'SOCIAL_ENGINEERING' flag. The domain is currently offline, though this status may change if the threat actors redeploy the infrastructure. Mitigation against crypto drainer threats requires a multi-layered approach. Users should verify the legitimacy of any domain requesting wallet connections or transaction approvals, particularly those mimicking DeFi services. Wallet security extensions and browser-based protections should be enabled to block known malicious domains automatically. Organizations and individuals should monitor for domains with future-dated registrations or those resolving to IPs with a history of hosting phishing infrastructure. In cases where exposure is suspected, immediate revocation of active wallet sessions and transaction approvals is recommended, followed by a review of all connected applications and authorized addresses. Security teams should update blocklists with the domain and associated IP to prevent future access attempts.