solana-vault[.]borrelly-betta[.]ts[.]net

The domain solana-vault.borrelly-betta.ts.net is currently active and classified as a high‑risk brand‑impersonation campaign targeting Solana. The site presents the page title “SolanaVault – Plateforme DeFi Solana en Développement”, indicating an attempt to lure users into a cryptocurrency‑related service. Registration data show the domain was created on 08 Oct 1996 and was registered through MarkMonitor, Inc., a registrar commonly associated with brand‑protective services.

Infrastructure analysis reveals that the domain resolves to IP 209.177.145.137, which is allocated to AS36236 NetActuate, Inc. and geolocated in the United States. The server presents a valid Let’s Encrypt certificate (issuer E8) and runs a Python environment with SimpleHTTP, consistent with a lightweight web stack. Nameservers are ns1.dnsimple.com, ns2.dnsimple‑edge.net, ns3.dnsimple.com and ns4.dnsimple‑edge.org. Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist.

Detection telemetry indicates that the domain is already blocked by PhishDestroy and that one of ninety‑five VirusTotal security vendors has flagged the site, demonstrating early but limited threat‑intelligence coverage. The combination of a brand‑specific page title, a low trust score, and active blocking suggests a deliberate attempt to exploit Solana users, potentially to harvest cryptocurrency credentials or funds.

Defenders should add 209.177.145.137 to network‑level deny lists and enforce DNS filtering for the full domain name. Monitoring of the associated nameserver infrastructure is advised, as changes may signal further campaign evolution. Log any HTTP 200 responses from this address and correlate with internal authentication attempts to Solana‑related services. Updating detection signatures with the observed Python/SimpleHTTP fingerprint will improve early containment.