app-sunrise[.]xyz

This domain, app-sunrise.xyz, is identified as a brand impersonation threat targeting the Solana ecosystem. Analysis indicates the site masquerades as a legitimate asset gateway under the page title 'Sunrise | Solana's Asset Gateway,' likely designed to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. No specific drainer kit signatures were confirmed, but the infrastructure aligns with known crypto-phishing campaigns exploiting decentralized finance (DeFi) branding to facilitate unauthorized transactions or credential harvesting.

Technical indicators reveal the domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other transient phishing infrastructure. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and ScamSniffer, indicating widespread recognition of its malicious intent. Google Safe Browsing (GSB) status was not explicitly provided but is likely marked as unsafe given the blocklist presence.

As of the latest assessment, app-sunrise.xyz has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains a residual risk due to the domain's recent registration and the registrar's history of hosting malicious activity. Users who interacted with the site prior to its takedown should revoke any connected smart contract approvals, monitor wallet activity for unauthorized transactions, and rotate credentials if sensitive information was disclosed. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Continued vigilance is advised, as threat actors may re-deploy similar infrastructure under new domains or IPs.