sol-vault[.]info

This domain is flagged as a brand‑impersonation site targeting Solana. The hostname sol-vault.info resolves to 172.67.147.108, which is owned by AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are amos.ns.cloudflare.com and dayana.ns.cloudflare.com, both standard Cloudflare resolver entries. No TLS certificate was observed for the domain, indicating that the service was reachable without HTTPS encryption at the time of capture.

The page title returned by the server was “Nur einen Moment…”, a German phrase that does not reference the Solana brand and suggests that the site may have been presenting a transient loading message rather than a legitimate login interface. VirusTotal recorded a single positive detection out of 95 scanned scanners, and the domain appears on one external security blocklist, currently listed by PhishDestroy. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The overall risk assessment is elevated, and the site is listed as offline in the latest intelligence, indicating that the active hosting has been taken down.

However, the underlying infrastructure – Cloudflare IP address and public name‑server configuration – remains reusable for future campaigns. Defenders should continue to block sol-vault.info at the DNS and proxy layers, monitor for re‑registration of the same name or similar variations, and consider adding the IP address 172.67.147.108 to network‑wide deny lists. Because the site lacks an SSL certificate, any future re‑appearance would likely be observable via clear‑text HTTP traffic, enabling early detection. Continuous review of threat‑intel feeds for additional detections will help maintain situational awareness.