solana-meneverse[.]mirjh[.]com

Analysis indicates that the domain solana-meneverse.mirjh.com was registered on 21 February 2026 through Cosmotown, Inc. and is hosted on IP 66.235.169.7, which belongs to AS397423 Tier.Net Technologies LLC located in the United States. The authoritative nameservers are ns7.dnscloudserver.com and ns8.dnscloudserver.com. No TLS certificate is presented for the site, meaning connections are unencrypted. The page title retrieved from the site reads “Solana Meneverse | $150,000 Exclusive Airdrop,” and the brand target is identified as Solana, suggesting an impersonation attempt aimed at cryptocurrency users.

The infrastructure matches the known “Airdrop Scam” phishing kit, a common vector for crypto‑related fraud. The domain has been flagged by multiple blocklist providers, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and appears on four additional security blocklists. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, providing further independent confirmation of malicious intent. Current status is reported as offline, which may indicate that the operators have taken the site down or are rotating infrastructure.

Because the site is no longer reachable, direct observation of the landing page content is not possible, leaving the exact visual lures and data‑capture mechanisms unverified. Defenders should continue to block the domain and its associated IP address, add the host to internal deny lists, and monitor for any future re‑registration or similar patterns using the same registrar, nameserver set, or hosting ASN. Ongoing threat‑intel collection should focus on detecting re‑use of the Airdrop Scam kit against the Solana brand and on correlating any new domains that resolve to the same IP range or share the same registration details.