solaxy-airdrop[.]icu

Analysis of solaxy-airdrop.icu shows a short‑lived domain created on February 21, 2026 that was used to impersonate the Bitget cryptocurrency platform and harvest wallet seeds. The site resolves to the Cloudflare address 172.67.166.189, belonging to AS13335, and is served from the United States. Registration details list Web Commerce Communications Limited dba WebNic.cc as the registrar, with authoritative nameservers ns100.webnic.cc and ns101.webnic.cc. The TLS certificate presented is identified as WE1, indicating a standard SSL deployment rather than a self‑signed or expired certificate.

HTTP requests to the domain now return an offline status, confirming that the site has been taken down, but the infrastructure footprint remains observable. Security intelligence confirms that five independent blocklist providers—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have already listed the domain, and VirusTotal’s scanning engine recorded five detections out of ninety‑three vendors, reinforcing the malicious classification. The page title returned by the web server is “Solana,” which aligns with the cryptocurrency focus of the campaign, though the specific page content has not been captured for further analysis. The operation is categorized as a wallet/seed phishing attempt, targeting users of Bitget by luring them to submit private keys or recovery phrases.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host header or similar subdomains, and flag any outbound connections to the associated IP address. Given the Cloudflare front‑end, future variants may leverage the same CDN network, so correlation with other recent Bitget‑related phishing domains is advised. Continuous re‑scanning of the domain through multi‑vendor services is recommended to capture any changes should the site become active again.