studio--solana-swap-cdxjl[.]us-central1[.]hosted[.]app

The domain studio--solana-swap-cdxjl.us-central1.hosted.app was observed returning HTTP 404 and presenting the page title “Firebase Studio App”. Registration records show the domain was created through MarkMonitor Inc., a registrar commonly used for legitimate brand assets, indicating an attempt to lend credibility to the infrastructure. The site impersonates the Solana brand and is classified as a crypto‑related scam. VirusTotal scans recorded four detections out of ninety‑five security vendors, and the domain appears on a single external blocklist.

PhishDestroy has already taken the domain offline, and current monitoring confirms the site is no longer reachable. DNS resolution points to the IP address 35.219.200.24, which belongs to AS19527 Google LLC and is geolocated in South Korea. The hosting environment is Google Cloud, employing Envoy as a reverse proxy, Google Cloud CDN, and HTTP/3 support. The TLS certificate is issued by Google Trust Services under the WR3 identifier, matching the Google Cloud hosting.

Nameserver delegation uses Google’s cloud DNS set (ns-cloud-b1.googledomains.com through ns-cloud-b3). The combination of a legitimate registrar, Google‑hosted infrastructure, and a modest detection footprint suggests a low‑profile campaign that relied on the perceived trust of the Solana brand and Google services. Defenders should continue to block the IP range associated with AS19527, monitor for any re‑registration attempts of similar subdomains, and update detection rules to flag the page title “Firebase Studio App” when coupled with Solana‑related keywords. Organizations using Solana assets should educate users about the offline status of this domain and reinforce verification of official URLs before any credential or transaction requests.