solflarer.vip

Analysis indicates that solflarer.vip was registered on 21 February 2026 and subsequently configured to serve a Solana‑based cryptocurrency draining kit. The domain resolves to the IP address 54.240.174.124, which is hosted within Amazon Web Services CloudFront infrastructure located in the United Kingdom. The TLS certificate presented by the site is an Amazon RSA 2048 M02 certificate, a standard certificate issued for AWS‑hosted services, and does not provide any intrinsic trust beyond confirming the hosting provider. The site was submitted to VirusTotal, where 93 scanning engines evaluated the host; none generated a detection at the time of analysis. While the absence of detections does not imply safety, it demonstrates that the payload or landing page evaded signature‑based identification during that scan.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one security‑focused organization recognized it as malicious. Current network checks indicate that the HTTP service is no longer reachable, and the domain status is listed as offline. No additional intelligence such as Safe Browsing alerts, Open Threat Exchange entries, or page‑title metadata is available. Consequently, the exact content served prior to takedown cannot be verified, though the association with a “Solana Drainer” kit strongly suggests attempts to illicitly transfer funds from victim wallets.

Defenders should continue to block traffic to 54.240.174.124 and to solflarer.vip at DNS and firewall layers. Monitoring for newly registered domains that share the same registrar or similar naming patterns is advisable, as actors often recycle infrastructure. Incident response teams encountering suspicious Solana‑related transactions should reference this indicator set when correlating logs. Because the site is offline, ongoing observation for re‑hosting on alternative IP ranges or re‑registration is recommended.