minesol[.]vip

On July 23, 2026, analysis of the domain minesol.vip revealed infrastructure consistent with a Solana‑related airdrop scam. The site was registered on February 21, 2026 and immediately began serving a page titled “SOLANA AIRDROP”. The page title and the declared brand target of Solana match the known “Airdrop Scam” phishing kit observed in multiple campaigns. The domain resolves to 104.21.88.76, an IP address owned by Cloudflare, Inc. (AS13335) located in the United States.

The SSL certificate presented is identified as “WE1”, a certificate frequently reused in fraudulent sites. VirusTotal records show that 14 of 93 scanning engines flagged the domain as malicious, indicating a moderate level of consensus among anti‑malware vendors. AlienVault OTX lists the domain in 14 separate threat‑intel pulses, reinforcing its association with the broader airdrop fraud ecosystem. The domain has been added to at least one public security blocklist and was actively blocked by the PhishDestroy mitigation service.

As of the reporting date the site has been taken offline, which limits real‑time observation but does not remove the underlying indicators. Uncertainty remains regarding the full scope of victim outreach, such as whether phishing emails or social‑media posts were used to drive traffic, because those vectors have not been publicly disclosed. Defenders should continue to monitor the IP address 104.21.88.76 for any re‑use, enforce blocklist entries for minesol.vip, and update endpoint protection signatures with the observed VirusTotal and OTX indicators. Organizations that hold Solana assets should educate users about unsolicited airdrop offers and advise verification through official channels before any credential or wallet information is entered.