sol-air[.]top

Analysis of the domain sol-air.top, observed on July 22, 2026, indicates that it is part of a brand‑impersonation campaign targeting Solana users. The domain was registered on July 08, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.95.82 located in the United States. The authoritative nameservers are louis.ns.cloudflare.com and raegan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. No SSL certificate is presented for the site, and the Gridinsoft trust score is 0 out of 100, suggesting a lack of credibility.

The only visible page title returned by the server is "Just a moment...", and the site is currently taken offline. Threat intelligence categorizes the activity as a crypto scam, specifically impersonating the Solana brand. VirusTotal reports a single detection out of ninety‑five scanned security vendors, and the domain is listed on one external blocklist, with PhishDestroy actively blocking it. These indicators collectively demonstrate malicious intent, though the limited detection count implies that the campaign may be low‑volume or recently deployed.

Defenders should add the IP address 104.21.95.82 to network‑level blocklists, monitor for any DNS queries to sol-air.top, and enforce TLS inspection to detect any future attempts to serve content without a valid certificate. Continuous re‑scanning on multi‑vendor platforms is recommended to capture any escalation in detection rates, and security teams should alert users of Solana‑related services about the impersonation attempt. The current evidence does not reveal the exact payload or phishing page content, so further passive and active investigations are warranted to fully characterize the threat vector.