dappaccess[.]web[.]app

This domain, dappaccess[.]web[.]app, is currently offline but was identified as a high‑risk crypto drainer targeting Solana users. Registration records show the domain was created through Google LLC, and the TLS certificate was issued by Google Trust Services under the WR4 profile, indicating a legitimate certificate authority was abused. The site presented the page title “This is a Verified protocol from the Blockchain Network System,” a phrasing that attempts to lend credibility while impersonating the Solana brand. Infrastructure analysis reveals the domain resolves to IP address 199.36.158.100, hosted in the United States and associated with AS54113 Fastly, Inc. The web server employed Firebase, enforced HTTP Strict Transport Security, and supported HTTP/3, suggesting a modern content delivery configuration. HTTP probing returned a 404 status, which is consistent with the site being taken offline after detection.

Threat intelligence links the activity to the Solana Drainer kit and a Seed Phrase Phishing module, both commonly used to harvest private keys and drain cryptocurrency wallets. The domain appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, and VirusTotal recorded eight detections out of ninety‑five scanning engines. Scamadviser assigned a trust score of 100/100, reinforcing the malicious nature of the site. The evidence set confirms deliberate impersonation of Solana and a targeted crypto‑drain operation.

Uncertainty remains regarding the exact time of compromise and any residual infrastructure that may still host the malicious payload, as the site is currently inaccessible. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed blocklist entries, and monitor the associated IP address for any re‑hosting activity. Threat hunters should correlate logs for DNS queries to dappaccess.web.