solanarewards[.]lol

solanarewards.lol is currently offline but historical data indicates it was used to impersonate the Solana blockchain ecosystem. The site presented the page title “Solana Rewards,” a naming pattern commonly employed in wallet‑seed phishing campaigns. The domain was registered on 28 September 2025 through NiceNIC International Group Co., Limited and resolves to IP 104.21.43.145, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate was observed, which suggests the site operated over plain HTTP. Infrastructure analysis shows the domain used Cloudflare’s default nameservers kayden.ns.cloudflare.com and mimi.ns.cloudflare.com, a configuration frequently seen in short‑lived phishing infrastructure. Multiple security feeds have flagged the domain.

PhishDestroy and ScamSniffer have listed it as blocked, and it appears on two public blocklists. AlienVault OTX recorded the domain in one threat‑intelligence pulse. Malware‑scanning services report a Gridinsoft trust score of 0 / 100. VirusTotal scans returned 12 positive detections out of 95 vendors, reinforcing the malicious assessment. The observed scam type is “Wallet/Seed Phishing,” indicating attempts to harvest private keys or recovery phrases from unsuspecting Solana users.

Because the domain is already taken offline, active mitigation is limited to preventive measures. Defenders should add the domain and its IP address to local and network‑level blocklists, ensure that DNS resolvers block the associated hostnames, and monitor for any re‑registration or use of similar sub‑domains. Continuous re‑query of VirusTotal, OTX and blocklist feeds is advised to capture potential re‑appearance. Given the absence of TLS, any future site serving the same host‑name over HTTPS would be a clear indicator of a new infrastructure, prompting immediate investigation.