mainnet-neon-solana-native-swap-demo[.]neontest[.]xyz

This domain, mainnet-neon-solana-native-swap-demo.neontest.xyz, operates as a crypto drainer targeting users of the Solana blockchain ecosystem. Analysis indicates the site impersonates legitimate Neon EVM signature demo interfaces, tricking visitors into authorizing malicious transactions that siphon digital assets from connected wallets. The threat specifically exploits trust in Solana’s infrastructure by mimicking native swap functionality, a common vector for financial theft in decentralized finance environments. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through Go Daddy, LLC on September 16, 2021, and is currently flagged by 10 out of 95 security vendors on VirusTotal. It appears on one security blocklist and resolves to the IP address 104.21.1.81, hosted on Cloudflare’s network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while the page title, 'Neon Solana Signature demo,' directly references the targeted brand to enhance deception. Users who interacted with this domain should immediately revoke any wallet authorizations granted to the site. This includes checking connected applications in Solana wallet interfaces and removing permissions for 'mainnet-neon-solana-native-swap-demo.neontest.xyz' or any unfamiliar contracts. Affected parties should also transfer assets to a new wallet address and monitor transaction histories for unauthorized activity. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts, particularly those leveraging Cloudflare-hosted infrastructure or Neon EVM branding. Security teams are advised to block the domain and associated IP at the network level to prevent further exposure.