mail-forge[.]email

This domain poses a high risk due to its active status and specific threat of brand impersonation targeting Solana. Analysis reveals it is a convincing phishing attempt designed to deceive users into surrendering their cryptocurrency credentials, functioning as a crypto drainer that may empty wallets upon connection. The domain was registered through Dynadot Inc on April 16, 2026, and resolves to the IP address 172.67.218.57, which is hosted behind Cloudflare for obfuscation. Its SSL certificate is issued by Let's Encrypt (E8), lending a false sense of security to unsuspecting visitors. VirusTotal data shows 2 out of 95 security vendors flagging this domain, and it already appears on one security blocklist, indicating community awareness. Trust scores remain critically low, matching the high-risk classification.

Given that this domain impersonates Solana and presents a matching page title, users should avoid entering any personal information or connecting their cryptocurrency wallets. The recommended mitigation steps include immediately blocking the domain at the network level, reporting it to Solana's security team and relevant phishing databases, and educating users to always verify URLs through official channels before interacting with any Solana-related services. PhishDestroy provides a safe verification platform where users can check domain legitimacy without risk. Security teams should also update their threat intelligence feeds with this indicator of compromise (IOC) to prevent future access. Continuous monitoring for similar domains using the same registration patterns is advised to preempt further phishing campaigns.