solrecover-reclaimsol[.]pages[.]dev

This domain, solrecover-reclaimsol.pages.dev, is actively engaged in brand impersonation targeting Solana, a major cryptocurrency platform. Analysis indicates the site mimics legitimate SOL recovery guides under the title 'ReclaimSOL — Clear Guides to Recovering SOL from Unused Accounts,' likely designed to deceive users into disclosing wallet credentials or executing malicious transactions. No direct evidence of a crypto drainer kit was observed, but the domain’s content aligns with known tactics used in wallet-draining schemes. Infrastructure analysis reveals the domain was registered on March 11, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335. VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious. The SSL certificate identifier is E8, and the domain appears on one security blocklist. No entries were found in Google Safe Browsing at the time of analysis. The page title and branding closely resemble Solana’s official communications, increasing the likelihood of successful social engineering. As of the latest assessment, the domain remains active and unmitigated. Response actions should include immediate blacklisting by security providers, takedown requests to the hosting provider, and public advisories to warn potential victims. The remaining risk is high due to the domain’s active status, low detection rate, and direct targeting of cryptocurrency users. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators of compromise, including the IP address 188.114.96.3 and any subdomains under pages.dev associated with this campaign.