solair[.]top

This domain, solair.top, is flagged as part of a crypto scam phishing infrastructure. Registered on February 21, 2026, through 耐思尼克国际集团有限公司, the domain resolved to IP address 172.67.204.133, hosted on Cloudflare's network (AS13335) in the United States. Analysis indicates the use of Cloudflare nameservers (lauryn.ns.cloudflare.com and mark.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site was detected using Cloudflare Browser Insights and HTTP/3, common in modern phishing setups for evasion and performance. At the time of assessment, the domain was offline, returning a page titled 'Just a moment...', a default Cloudflare interstitial often seen during bot challenges or misconfigurations.

Security vendors on VirusTotal flagged solair.top, with 7 of 93 engines classifying it as malicious. It also appears on one security blocklist, specifically PhishDestroy. The scam type is explicitly identified as a crypto scam, though the exact mechanics—such as wallet drainers, fake exchanges, or investment fraud—remain unconfirmed due to the lack of accessible page content. Defenders should treat this domain as high-risk for financial fraud targeting cryptocurrency users.

The use of Cloudflare infrastructure suggests attempts to obscure hosting origins and evade takedowns. While the domain is currently offline, historical resolution to 172.67.204.133 and registration details provide pivot points for further investigation. Security teams are advised to block traffic to solair.top and monitor associated IPs or certificates for resurgence. No additional brand impersonation or kit details are available from the current evidence.