solana-gain[.]com

This domain is flagged as a high-risk cryptocurrency scam impersonating the Solana brand. Analysis reveals that solana-gain.com was registered on October 3, 2025, through Dominet (HK) Limited, a Hong Kong-based registrar, and is currently active. It resolves to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. in the United States (AS13335). The domain uses Cloudflare's nameservers, fonzie.ns.cloudflare.com and luciana.ns.cloudflare.com, and is protected by Cloudflare's infrastructure, including HTTP/3 and Cloudflare Browser Insights. The SSL certificate is issued by Google Trust Services, indicating encrypted connections but not safety. The page title, Nur einen Moment…, is a generic German phrase meaning Just a moment…, often used by Cloudflare or scam pages as a loading or redirect message. The HTTP status is 403 (forbidden), suggesting access is blocked or restricted, possibly to evade analysis. The domain appears on only one security blocklist, yet VirusTotal flagged it as malicious by 10 out of 95 security vendors, indicating broad but not universal detection. Gridinsoft gives a trust score of 0 out of 100, reinforcing the lack of credibility. It has been found in one threat intelligence pulse on AlienVault OTX, and it is blocked by the PhishDestroy blocklist. The specific scam type is cryptocurrency, and the domain impersonates Solana, a blockchain platform. However, the exact content of the site has not been analysed, so the methods of deception, such as fake login pages or wallet drainers, remain uncertain. Defenders should treat this domain as confirmed phishing infrastructure. It is recommended to block access at the network level, add solana-gain.com to denial lists, and educate users that it is an impersonation site. Monitoring for related domains registered through the same registrar or using similar Cloudflare configurations is advised, as further threats may emerge from this operator.