recovery[.]solanareclaim[.]com

Analysis of recovery.solanareclaim.com shows a confirmed crypto‑related brand‑impersonation campaign targeting Solana users. The domain was registered on February 21, 2026 through Spaceship, Inc., and is served from the IP address 64.29.17.195, which belongs to AS16509 Amazon.com, Inc. and resolves to a US location. DNS resolution uses the nameservers launch1.spaceship.net and launch2.spaceship.net. The site presented the page title "Claim Recovered Fees - Solana Fee Recovery," indicating a fraudulent fee‑recovery narrative designed to lure cryptocurrency holders.

Technical fingerprints reveal the use of Vercel as the hosting platform and the presence of HTTP Strict Transport Security (HSTS). The SSL certificate is issued by Let’s Encrypt (R13), confirming that encryption is in place but does not attest to legitimacy. VirusTotal recorded a single positive detection out of 93 security vendors, and the domain appears on one external blocklist. It has been flagged and taken offline by the PhishDestroy mitigation service.

Defenders should immediately add recovery.solanareclaim.com to URL filtering and DNS blocklists, monitor traffic to the associated IP 64.29.17.195 for any residual connections, and update intrusion detection signatures to include the observed Vercel‑based hosting pattern and the specific page title string. Because the site leveraged Solana branding to suggest a fee‑recovery scam, organizations handling Solana assets should educate users about unsolicited fee‑recovery claims and enforce multi‑factor authentication for wallet access. Continuous threat‑intel feeds should be consulted for any re‑use of the Spaceship registrar or Vercel infrastructure in future impersonation attempts.