VirusTotal
5 / 89 engine detections
打开报告“Solana Sniper | Automated Solana Token Sniping”
加密钱包盗取程序: solanax.lol — 内容不可用. 证据摘要: VirusTotal 5/89 (alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar); 3 external blocklist matches…
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
5 / 89 engine detections
打开报告15/100
打开报告checked — no detections recorded
打开报告3 community references
打开报告provider verdict: clean
打开报告No threat flag
打开报告No malicious flag
打开报告Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
solanax.lol is a crypto wallet drainer impersonating Solana, built to steal funds from users who connect their wallets to the site. It targets Solana ecosystem participants with a fraudulent interface designed to look legitimate. PhishDestroy first identified it on 2026-09-12, just eight days after the domain was registered on 2026-09-04. The site went offline almost immediately, with DNS going inactive by 2026-09-13, and remains dead as of 2026-10-17.
The site presented itself under the page title "Solana Sniper | Automated Solana Token Sniping", framing itself as an automated token-sniping tool to attract Solana traders looking for an edge. The page title describes a token sniping tool, while our classification is a crypto wallet drainer; both descriptions may reflect different stages or components of the same malicious page. The underlying kit is a Solana Drainer: once a visitor connects their wallet, the kit requests broad transaction approvals and silently transfers tokens and SOL out of the victim's wallet. The victim loses whatever assets the drainer can reach before they realize something is wrong.
Five of 89 engines on VirusTotal flagged solanax.lol as malicious as of 2026-09-16; the detecting vendors are alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, and SOCRadar. While five detections is a relatively low count, the site also appears on four independent blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. Three OTX threat-intelligence pulses further corroborate the classification. Taken together, the blocklist coverage and pulse activity provide strong independent backing even where antivirus coverage is limited.
The domain was registered on 2026-09-04 through Global Domain Group LLC. Hosting resolves to IP 188.114.97.3 on AS13335, Cloudflare's network, located in the United States. The TLS certificate was issued by Google Trust Services under the WE1 intermediate. The domain used the .lol top-level domain, which carries no inherent trust.
If you visited solanax.lol but did not connect a wallet or sign any transaction, no immediate action is required beyond ensuring your browser and security software are up to date. If you connected a wallet, revoke all token approvals granted to any contract associated with the site immediately using a trusted approval-management tool, then move remaining assets to a fresh wallet address. If you signed a transaction, assume any accessible funds in that wallet are compromised and act accordingly. Security teams and wallet providers should ensure solanax.lol and its associated infrastructure are present on their blocklists.
Full extracted values, their blockchain and collection source. An address found in page content does not establish who controls it.
https://t.me/solanassniperbotStored page referenceIoC extraction recorded 2026-09-13 04:00:10 UTC
Last checked
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Edge-IP 声誉不属于此域。
diana.ns.cloudflare.comjohnny.ns.cloudflare.comLocation describes the IP network.
a4cc3f6b1204a8d9d7de1a660010268a5b0558eaab03569c4305cb904023acd8Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of solanax.lol · checked Sep 12, 2026
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
solanax.lol
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
未知→dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
不可用→可访问
可访问→不可用
可访问
No threat flag
View source5/89 engine detections
View source3 community references
View sourcePD-20260912-6A14D0
solanax.lol
View sourcePage captured
View source已存储 118 个仿冒域名
显示 118 个中的 100 个
PD-20260912-6A14D0 Recipient: abuse@globaldomaingroup.com 如果您与此域交互、输入个人信息或连接加密货币钱包,请立即采取行动。以下资源可帮助您报告事件并保护自己。
选择您所在的国家/地区以获取 官方网络犯罪联系人 或 创建投诉草稿 →。
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
据估计 $51 billion 于2024年流入非法加密货币钱包(source). 如果你曾与 solanax.lol — 立即行动。
Wallet-specific steps below apply if you connected a wallet, signed a transaction, or exposed a wallet secret.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
据 联邦调查局,其中最重要的细节是交易数据:
0x5856...35985)solanax.lol)即使你并不了解所有细节—— 不管怎样都要提交报告. 即使信息不完整,对调查仍有帮助。
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.