prosolweb[.]xyz

This domain, prosolweb.xyz, is identified as a high-risk brand impersonation threat targeting Solana cryptocurrency users. Analysis indicates the infrastructure is designed to deploy wallet drainer kits, tricking victims into connecting their wallets to malicious smart contracts that execute unauthorized transactions. The page title explicitly mimics the legitimate Solana brand, increasing the likelihood of successful social engineering attacks against users seeking official Solana services or airdrops. Infrastructure analysis reveals the domain was registered on March 22, 2026, through OwnRegistrar, Inc., and resolves to the IP address 188.114.97.3, located in Canada and associated with a known content delivery network provider. The domain appears on three security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal, confirming its malicious classification. Additional technical indicators include detection by multiple independent threat intelligence feeds, though it is not currently listed in Google Safe Browsing at the time of analysis. The domain has been taken offline, likely in response to detection and blocking by security platforms. However, remaining risk persists due to the potential for rapid redeployment of similar infrastructure under new domains or subdomains. Users are advised to verify domain authenticity through official channels before interacting with any Solana-related websites. Organizations should monitor for related indicators of compromise, including the IP address and registrar details, to prevent future exposure to this threat actor's infrastructure.