Add warnonsol.top to blocklist

[NoirReports]

Blocklist Addition: warnonsol.top

Summary

Adding warnonsol.top to the Phantom blocklist. This domain is an active Solana wallet drainer — it prompts users to connect their Phantom wallet and then submits malicious transactions to steal all SOL and SPL tokens.

Evidence

(no automated scan available)

Domain Intelligence

(no WHOIS/intel data available)

Attack Details

• Target: Phantom and other Solana wallet users
• Method: Fake dApp UI → wallet connection prompt → malicious drain transactions
• Impact: Complete wallet drain (SOL + all SPL tokens)
• Distribution: Social media, Discord DMs, fake airdrop campaigns
• Technical: Obfuscated JS, anti-analysis techniques, transaction simulation spoofing

Verification

• Confirmed the domain is actively malicious
• Domain is not already on the blocklist
• Simultaneously reported to MetaMask, Solflare, ScamSniffer, and Google Safe Browsing