flopisoiana[.]xyz

Analysis of flopisoiana.xyz indicates a targeted brand‑impersonation campaign aimed at Solana users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to IP address 104.21.72.19, which is part of Cloudflare’s AS13335 network located in the United States. The authoritative nameservers are clark.ns.cloudflare.com and ulla.ns.cloudflare.com. No SSL/TLS certificate is presented, and the site currently returns an offline HTTP status, confirming that the content is not reachable at the time of assessment.

The page title retrieved before takedown reads "Flopi - The cutest, floppiest friend on Solana," explicitly referencing Solana and supporting the classification as a crypto‑related impersonation. VirusTotal scans show four detections out of ninety‑three security vendors, reinforcing the malicious nature of the host. The domain is listed on two external blocklists, PhishDestroy and ScamSniffer, which have already flagged it as a crypto scam. The evidence collectively points to a deliberate attempt to lure Solana community members, likely by promoting a fabricated “Flopi” service or token.

Defenders should add flopisoiana.xyz to internal URL filtering and DNS block policies, monitor the Cloudflare IP range for any re‑use of the same address, and watch for re‑registration of the domain. Continuous observation of the registrar NiceNIC and the associated nameservers is advised, as threat actors often resurrect similar infrastructure under new labels. Organizations that interact with Solana ecosystems should alert users to the specific page title and the lack of a valid TLS certificate, reinforcing that any unsolicited links claiming to offer Solana‑related benefits from this domain are malicious.