Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
soi-incinerator.com shows high-risk / scam indicators.
| What this site appears to be | A Solana wallet utility that asks users to connect a wallet and sign transactions to close empty token accounts and reclaim rent SOL, with a stated 2% fee. Operator identity, contact details, and the on-chain claims cited are not verifiable from the page, and the required token-approval step is unexplained. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1.8 years oldRegistered history | Clear |
| Web archive | Archived since 202411 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
Sol Incinerator is a Solana wallet-utility website. It describes itself as a "free Solana wallet cleaner" that lets visitors connect a wallet and sign transactions to close empty token accounts and reclaim the roughly 0.002 SOL rent deposit held in each. A "Pro Mode" for burning unwanted tokens and NFTs, Jupiter token swaps and mass transfers sit alongside it. It is a fee-based crypto utility: the operator keeps a stated 2% of reclaimed SOL on cleanups and about 5% on NFT burns.
Scam/Impersonation Risk
The contradictions here are decisive. The domain appears on a confirmed blacklist and is flagged as malicious by several independent threat-intelligence engines. That is the strongest signal in the assessment, and no other feature of the site offsets it. No brand impersonation and no conflicting legal identities were observed, so the elevated risk rests on the blacklisting and on the nature of the interaction. The homepage requires a wallet connection and transaction signing, then states that "approving the tokens you hold" is required for the tool to work. That step is never explained. Token-approval language of this kind can grant a third party control over assets, and it is the pattern most often abused in wallet-draining schemes. The homepage also makes several unsupported claims. It says "verified on-chain" and "trusted since December 2021", and it shows a live claim counter, but it links no evidence for any of them. The "since December 2021" claim does not fit the domain's recent registration or its archive footprint, both logged below. The homepage FAQ promises that the free mode "only closes empty token accounts" and "never burns tokens or NFTs". That promise rests entirely on the operator's word and can only be checked by inspecting the transaction a wallet is asked to sign. In the behavioral sandbox, the page made no external calls, showed no hidden forms, no clipboard manipulation, no cloaking and no wallet-drainer behavior. That is a mitigating observation about the captured sessions only. It does not neutralize a blacklisting or an unexplained approval step.
- Homepage: the connect-wallet flow requires transaction signing, and the page states that approving held tokens is "required" without saying what is approved or why.
- Homepage: "verified on-chain", "trusted since December 2021" and a live claim counter appear with no linked proof.
- Domain history: the current registration dates from 2026-08-30 (~0.14 years old), while the web archive holds 11 snapshots spanning 2024-12-17 to 2025-07-13 (2 years tracked).
- Behavioral sandbox: 3 of 3 runs completed with no external network activity and no wallet-drainer, clipboard-hijack or cloaking behavior detected.
Regulatory Verification Notes
The site presents no legal entity, registered address, licence or regulatory registration, and no direct contact channel. The fee recipient and the terms for handling the 2% and 5% fees are also unstated. For a service that moves user funds, these are material disclosure gaps. The operator's real-world identity is unverified, and the site's own description of itself cannot stand in for it. Ownership details are incomplete, and the page does not explain who operates the Pro Mode, swap and mass-transfer features. No third-party broker or regulatory listing matched this domain. The absence of a licence is a transparency gap, not proof of wrongdoing, but here it comes on top of a blacklisting.
- Homepage: no company name, jurisdiction, licence number, physical address or contact route is displayed.
- Fee disclosure: the stated 2% cleanup fee and about 5% NFT-burn fee have no named recipient or terms.
- Registration record: registered 2026-08-30 through Dominet (HK) Limited, with expiry 2027-08-30 and incomplete owner details.
- Hosting and encryption: served from AS13335 (Cloudflare, Inc., US); the TLS certificate is a domain-validated (DV) certificate from WE1, valid to 2026-11-28.
What to Verify Next
Any interaction should start from the operator's genuine identity, not from this domain. Locate the project's official channels through an independent route, such as an established directory or the Solana community's recognised sources, and confirm that this exact domain is linked from them. The "December 2021" operating history should be checked against independent, dated third-party references. Wallet users should inspect the full transaction in the wallet's own confirmation screen before signing anything. Any instruction that approves, delegates or transfers token authority, rather than only closing empty accounts, should be refused. Official support and contact channels should be confirmed through a source independent of this site. Since the blacklisting is current, the domain should be re-checked against the listing sources before any reconsideration.
- Homepage: the unexplained token-approval requirement is the key item to resolve before any wallet interaction.
- Homepage: the operating-history claim needs independent dating evidence, since the domain registration and archive footprint begin much later.
- Wallet interface: the confirmation screen is the only reliable view of what a signature would authorize.
Summary Verdict
The site carries an elevated risk posture. Current threat-intelligence listings and a wallet-signing financial flow with unexplained approval requirements outweigh the technical hygiene present. Apparent operational stability and the absence of observed impersonation do not establish that the operator is legitimate, and the operator's identity remains unverified. The assessment is clearly cautionary.
Infrastructure Integrity
The site sits behind a mainstream CDN and web application firewall, with a valid TLS certificate, and all observed addresses are CDN edge servers. This protects the site against some forms of attack and shows a basic level of infrastructure hygiene. It is a mitigating factor only. The origin server was not observable, so independent hosting verification is limited, and edge-only visibility can mask rapid content changes. Protective infrastructure is also freely available to any operator and cannot offset the threat-intelligence listings.
Closing Assessment
The site should be limited to read-only viewing. Wallets should not be connected, no transactions should be signed, and no tokens, NFTs or funds should be committed through this domain until the blacklisting is cleared and the operator is independently verified. Anyone who has already connected a wallet or signed a transaction here should review and revoke token approvals using a trusted wallet tool and monitor the wallet for unauthorized activity.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by governance, external reputation, page content.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME - The browser raised a warning while loading the page.Page content
rule:PAGE_BROWSER_FLAGS_SUSPICIOUS
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of soi-incinerator.com.
- The request stayed on soi-incinerator.com. It was not redirected to another domain. Clear
- Registration is published under Dominet (HK) Limited. Clear
- DNS for this domain is served by cloudflare.com, across 4 name servers. Noted
- The registration is paid up to 2027-08-30. Noted
- The earliest public archive of this site is from 2024-12-17. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Dominet (HK) Limited |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3036::6815:6f |
| Name servers | DANA.NS.CLOUDFLARE.COM, ETHAN.NS.CLOUDFLARE.COM, NS1.NONVERIFIEDDOMAIN.COM, NS2.NONVERIFIEDDOMAIN.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 6 |
| Edge IP addresses | 6 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-11-28 |
| Domain age | 1.84 years (continuous registration) |
| Domain expiry | 2027-08-30 |
| Archive first seen | 2024-12-17 |
| Archive snapshots | 11 |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about soi-incinerator.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.