daddychillsolana[.]com

Analysis of daddychillsolana.com shows a recently registered domain (creation date February 22, 2026) that has been used for a brand‑impersonation crypto scam targeting Solana users. The domain resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS is hosted on Cloudflare name servers dean.ns.cloudflare.com and priscilla.ns.cloudflare.com, and the site does not present an SSL/TLS certificate, indicating that any HTTP traffic would have been unencrypted. The only visible page element is the title tag, which simply repeats the domain name. Threat intelligence flags the site as a crypto scam and notes that it impersonates the Solana brand.

It has been blocked by the PhishDestroy service and appears on a single external blocklist. VirusTotal analysis recorded a single vendor detection out of ninety‑five scanners, suggesting at least one security product identified the domain as malicious. Current operational status is offline, which may be temporary or part of takedown efforts. Defenders should continue to block the domain at the network perimeter and add the associated IP to any existing Cloudflare‑origin deny‑list, as the IP is shared among many legitimate services and may be reused.

Monitoring for re‑registration of the domain or for similar domains registered by the same registrar (NiceNIC International Group Co., Limited) is advisable. Because the site lacks SSL, any future attempts to serve content over HTTPS would require a new certificate, providing an additional detection point. Organizations should educate users about unsolicited Solana‑related messages and enforce verification of legitimate URLs before any crypto transactions. Continuous threat‑intel feed updates are recommended to capture any new detections related to this indicator.