airdropfindersol[.]fun

On July 24, 2026, the domain airdropfindersol.fun was observed to host a credential‑collection site that purports to be a Solana airdrop scanner. The page title returned by the server – “Airdrop Finder - Claim the airdrops you missed | Solana Wallet Scanner” – directly references the Solana brand, confirming a brand‑impersonation intent. The site was built with a Node.js stack using Vue.js, Nuxt.js, Tailwind CSS and Cloudflare Browser Insights, and was delivered over HTTP/3 via Cloudflare’s network (AS13335, United States). No TLS certificate was presented, indicating the site operated without HTTPS.

DNS resolution points to the IP address 172.67.185.54, which is owned by Cloudflare, and the domain’s authoritative nameservers are kay.ns.cloudflare.com and trey.ns.cloudflare.com. Registration data shows the domain was created on March 06, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal recorded a single positive detection out of 95 scanners, and the domain is listed on three external blocklists. Independent phishing‑mitigation services PhishDestroy, MetaMask and SEAL have already added the domain to their block lists.

The infrastructure matches known patterns of the “Airdrop Scam” phishing kit, which is commonly used to harvest cryptocurrency wallet credentials. The domain is currently offline, but the combination of recent registration, brand‑specific page title, identified kit, and multiple blocklist entries suggests a purposeful, short‑lived campaign targeting Solana users. Defenders should continue to monitor the IP address 172.67.185.54 for any re‑use, enforce strict URL filtering for any sub‑domains that resolve to the same Cloudflare edge, and update endpoint protection rules to flag the “Airdrop Scam” kit signatures. Users of Solana wallets should be warned that unsolicited airdrop claims linked to this domain are malicious, and any credential entry should be considered compromised.