solmanager1gen[.]com

This domain, solmanager1gen.com, was created on 18 June 2025 through GoDaddy.com, LLC and currently resolves to the IPv4 address 67.217.228.104, which is hosted by BL Networks (AS399629) in the United States. The web server presents an HTTP 200 response and is identified as running Ubuntu with Nginx, secured by a Let’s Encrypt certificate (issuer E8). The page title returned by the server is “Solana Wallet Toolkit”, indicating a direct attempt to mimic Solana‑related tooling. Google Safe Browsing classifies the site as a social‑engineering threat, and the domain is listed on at least one public security blocklist and has been blocked by the PhishDestroy service.

A Gridinsoft trust score of 0 out of 100 further reflects the malicious nature of the host. VirusTotal analysis shows that 13 of 95 scanning engines flag the domain, reinforcing the suspicion of malicious activity. The domain’s nameservers are ns47.domaincontrol.com and ns48.domaincontrol.com, typical of GoDaddy’s default configuration. The available evidence points to a high‑risk brand‑impersonation campaign targeting users of the Solana ecosystem, likely aiming to harvest private keys or funds under the guise of a wallet utility.

No additional content has been observed beyond the page title, and the exact phishing flow remains unverified. Defenders should block outbound connections to 67.217.228.104 and add solmanager1gen.com to internal deny lists. Email filtering rules should be updated to flag messages referencing “Solana Wallet Toolkit” or containing links to this domain. Continuous monitoring of the domain’s DNS resolution and any changes to its SSL certificate or hosting provider is recommended, as infrastructure shifts are common in active campaigns.