photon-sol[.]tinyastro[.]io

photon-sol.tinyastro.io is a newly registered site (created 21 Feb 2026) that mimics the branding of base. The page title "Photon - Your Trusted Platform for Token Discovery & Trading" is crafted to appear legitimate, and the domain resolves to the Cloudflare edge address 172.64.154.240. The site returns a 403 HTTP response for generic requests, indicating that content is likely delivered only after specific query parameters, a behavior often seen in wallet_connect_phish campaigns.

The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid public certificate. DNS resolution is handled by Cloudflare authoritative nameservers will.ns.cloudflare.com and diva.ns.cloudflare.com, and the hosting AS is 13335 (Cloudflare, Inc.) located in the United States. Fingerprinting shows a Ruby on Rails application, HSTS enforcement, and HTTP/3 support, all consistent with modern web stacks and the observed page title.

Classification data lists the campaign as a "wallet_connect_phish" type, suggesting the site attempts to harvest wallet connection credentials via a deceptive WalletConnect flow. The domain appears on one security blocklist and is actively blocked by PhishDestroy. No detections were reported on VirusTotal (0/95) and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious intent despite the lack of automated flags.

Defenders should add photon-sol.tinyastro.io to URL filtering and blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce strict validation of WalletConnect URLs in client applications. Incident response teams should treat any credential submissions to this domain as compromised, and users should be instructed to revoke any authorizations granted to the site through wallet providers. Continuous observation of the domain’s activity is recommended while the investigation remains open.