sol-mooney[.]com

The domain sol-mooney.com was registered on 21 February 2026 through Key-Systems GmbH and immediately began serving web content that mimics the official Solana brand. The page title is identical to the domain name and the site advertises cryptocurrency-related services, a pattern consistent with known Solana impersonation campaigns. PhishDestroy has already placed the domain on its blocklist, and the threat is classified as high-risk brand impersonation targeting Solana users. The site returns HTTP 200 responses and lacks a valid TLS certificate, allowing traffic over plain HTTP only.

Technical analysis shows that sol-mooney.com resolves to the IP address 172.67.178.227, which belongs to the Cloudflare network (AS13335) and is physically located in the United States. The domain is served from Cloudflare’s edge without a dedicated SSL certificate, resulting in a Gridinsoft trust score of 0 out of 100. VirusTotal scans have flagged the domain in 11 of 95 security engines, indicating a moderate detection rate. The authoritative nameservers are ns1.emailverification.info and ns2.emailverification.info, both unrelated to the Solana ecosystem, further confirming the malicious infrastructure.

Defenders should treat sol-mooney.com as a confirmed malicious actor and block all network traffic to the domain and its resolved IP address. Email gateways and web proxies ought to enforce strict TLS inspection to detect the lack of a valid certificate and drop clear-text HTTP requests. Continuous monitoring of the associated nameservers and Cloudflare edge IP ranges can help identify future replicas that reuse the same hosting pattern. Incident response teams should also educate users about the Solana brand impersonation tactics and advise against any unsolicited cryptocurrency transactions originating from this domain.