refundyoursol[.]top

Analysis of refundyoursol.top indicates a crypto-focused phishing domain impersonating Solana, active since February 21, 2026. The domain was flagged by two security blocklists (PhishDestroy, ScamSniffer) and assigned a Gridinsoft trust score of 0/100, signaling high-risk classification. Infrastructure review shows the domain resolves to 172.67.135.105, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by WE1, a common provider for low-reputation domains.

The page title, 'Refund Your SOL - Easily Recover SOL from Your Wallet,' explicitly targets cryptocurrency users with a refund scam narrative. One of 93 security vendors on VirusTotal detected the domain as malicious at the time of assessment. Current status is offline, though defenders should treat the domain as compromised infrastructure.

No evidence links the domain to a specific phishing kit or additional threat actor infrastructure. Defenders are advised to block the domain and IP at perimeter controls, monitor for re-registration or DNS changes, and correlate with wallet addresses or transaction patterns if historical logs exist. The exact content and functionality of the site remain unanalyzed due to its offline status.