feeliq[.]lat

Analysis performed on July 23, 2026 indicates that the domain feeliq.lat was registered on March 17, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 104.21.72.178 (AS13335, United States). The site served content built on the Bootstrap framework and leveraged Cloudflare Browser Insights and HTTP/3, confirming the use of Cloudflare's edge network. The page title returned by the HTTP response is “Airdrop”, and the underlying phishing kit has been identified as the “Airdrop Scam” kit, a known wallet/seed phishing template that targets cryptocurrency users. The kit specifically impersonates the Solana brand, as reflected in the intelligence that lists Solana as the brand target.

Reputation checks show that feeliq.lat appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis returned 14 positive detections out of 94 scanned security vendors, providing independent confirmation of malicious intent. The domain’s nameservers are june.ns.cloudflare.com and nikon.ns.cloudflare.com, further tying the infrastructure to Cloudflare. No additional content beyond the title has been captured, so the exact phishing landing page layout, credential collection fields, or any SSL certificate details remain unverified.

However, the combination of a brand‑targeted kit, a high‑confidence blocklist presence, and multiple vendor detections establishes a high risk profile consistent with wallet/seed phishing campaigns. Defenders should continue to block feeliq.lat at DNS and proxy layers, add the IP 104.21.72.178 to network‑level deny lists, and monitor for any re‑registration attempts. Incident response teams handling Solana‑related user reports should treat contacts from this domain as compromised and advise affected users to rotate wallet seeds and revoke any tokens potentially exposed.