solana-vm[.]pages[.]dev

Analysis as of July 24, 2026 shows that the domain solana-vm.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is served from Cloudflare’s edge network (IP 188.114.97.3, AS13335, United States). The site returns HTTP 403 and the page title is "Suspected phishing site | Cloudflare", indicating that Cloudflare’s automated protection has already flagged the content. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the malicious intent. Reputation services provide low confidence scores: Gridinsoft assigns a trust score of 0/100, Scamadviser rates the domain 5/100, and three independent blocklists (PhishDestroy, ScamSniffer, Enkrypt) have listed the domain.

VirusTotal analysis shows six of ninety‑three scanners flag the domain as malicious, supporting the classification as a crypto‑drainer campaign. Detected technologies include HSTS, Cloudflare, and HTTP/3, all typical of Cloudflare‑protected sites but not indicative of benign behavior. The campaign is identified as a "Crypto Scam" employing the Solana Drainer kit and explicitly impersonates the Solana brand. The domain currently appears offline, but the infrastructure—a Cloudflare‑fronted IP address and the use of a legitimate SSL certificate—suggests the operators can quickly redeploy the payload on a new sub‑domain.

Defenders should continue to block the resolved IP address 188.114.97.3, add the domain to internal URL filtering lists, and monitor for any re‑appearance of similar "-vm.pages.dev" sub‑domains. Correlation with other Solana‑related indicators of compromise, especially those referencing the Solana Drainer kit, is recommended. Because the domain was flagged by multiple commercial scanners and appears on three blocklists, it should be treated as high‑confidence malicious activity.