solstorm-com[.]pages[.]dev

PhishDestroy identifies the domain solstorm-com.pages.dev as an active crypto drainer posing as a legitimate service. This domain is currently engaged in malicious activities aimed at deceiving users into connecting cryptocurrency wallets, with the ultimate goal of draining funds under false pretenses. The threat remains active and requires immediate attention from security teams and affected users.

This domain was flagged by 1 of 95 VirusTotal vendors and appears on a single security blocklist maintained by ScamSniffer. The domain resolves to the IP address 188.114.96.3 and is registered through Cloudflare, Inc. While the exact registration date is not provided in the available intelligence, the domain operates under a Google Trust Services SSL certificate, which adds a deceptive layer of legitimacy. The minimal detection rate and single blocklist presence suggest this campaign may be newly emerged or highly targeted, complicating early-stage mitigation efforts.

The current status of this domain remains active, with no evidence of takedown or remediation at this time. Security teams are advised to block this domain at the network perimeter and update firewall rules accordingly. Users are strongly urged to avoid interacting with this domain or any associated links and to verify the legitimacy of websites before connecting cryptocurrency wallets. Additionally, organizations should monitor for any new domains mimicking legitimate services and consider deploying advanced threat intelligence solutions to detect similar campaigns early.