sol[.]emmn[.]io

Analysis of sol.emmn.io, observed on July 25 2026, identifies the domain as a brand‑impersonation campaign targeting Metamask. The site was registered on 21 February 2026 and resolved to IP address 191.96.56.44, which belongs to AS47583 Hostinger International Limited and is geolocated in the United States. The page title retrieved before takedown read “Solaxy Token: SOLX Layer 2 Token I Best Crypto Presale 2025”, indicating a crypto‑presale narrative that aligns with the listed scam type of “Crypto Scam”. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in legitimacy. VirusTotal scans recorded two positive detections out of ninety‑five participating vendors, corroborating the malicious classification. SSL inspection shows the certificate is identified as “R11”, a pattern frequently associated with low‑quality or self‑signed certificates used in fraudulent deployments. The host is currently offline, which prevents immediate interaction but does not eliminate the risk of re‑use of the same infrastructure.

Defenders should add sol.emmn.io to internal deny lists, monitor the associated IP range for future activity, and watch for newly registered domains that resolve to the same hosting provider or exhibit similar page‑title phrasing. Continuous observation of blocklist updates and VirusTotal feeds is recommended to capture any resurgence of the campaign. The combination of recent creation, low trust score, positive vendor detections, and explicit Metamask impersonation suggests an elevated risk profile despite the current offline status.