solayerlabs[.]foundation

This domain, solayerlabs.foundation, is identified as a generic phishing site impersonating the Solayer Foundation, a cryptocurrency-related entity. The page title explicitly mimics the legitimate Solayer Foundation branding, suggesting an intent to deceive users into disclosing sensitive information, likely targeting cryptocurrency wallet credentials or personal data. No specific drainer kit signatures were observed in the available telemetry, but the domain's structure and impersonation tactics align with broader cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on February 17, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IPv6 address 2a06:98c1:3120::3, hosted on Cloudflare's network (AS13335) in the United States. The domain is flagged by 14 out of 95 security vendors on VirusTotal, with detections from two independent blocklists: PhishDestroy and ScamSniffer. Notably, the domain lacks an SSL certificate, a red flag for user trust and a common omission in low-effort phishing operations. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect a lag in detection rather than absence of malicious intent. As of the latest assessment, solayerlabs.foundation has been taken offline, likely in response to blocklist enforcement or registrar intervention. However, the elevated risk level persists due to the domain's recent creation and the potential for re-deployment under a new infrastructure. Users who interacted with the domain prior to its takedown should assume credential compromise and initiate remediation protocols, including password resets and wallet address verification. Organizations are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP range, as these may indicate follow-up campaigns.