solar-sanat[.]net

Analysis of solar-sanat.net as of July 22, 2026 shows that the domain is actively used in a generic phishing campaign. The domain resolves to the IPv4 address 45.14.135.25 and is served by the authoritative name servers ns10.airodns.com and ns11.airodns.com, which are operated by the DNS provider AiroDNS. Registration records indicate the domain was created on November 16, 2017 through the registrar 1API GmbH, suggesting the infrastructure has been maintained for several years. VirusTotal has received submissions from 95 scanning engines, of which 18 flagged the domain as malicious, reinforcing the suspicion of abusive activity.

The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. No additional public threat intelligence sources such as OTX or Safe Browsing entries are referenced in the available data. The observable evidence confirms that the domain is associated with phishing activity, but the specific payload, targeted brand, or compromised credentials have not been disclosed in the supplied intelligence. Consequently, the exact tactics, techniques, and procedures employed by the actors remain uncertain.

Defenders should continue to block traffic to 45.14.135.25 and to solar-sanat.net at network perimeters, update endpoint and DNS filtering policies to include the domain and its name servers, and monitor for any new detections in threat feeds. Given the relatively low blocklist presence, the domain may be evading broader detection, so organizations should consider adding the IP address to reputation‑based deny lists in addition to the domain name. Ongoing surveillance of its resolution patterns and any future VirusTotal submissions is advised.