x-solana[.]fun

Analysis of the domain x-solana.fun, registered through NiceNIC International Group Co., Limited on October 31 2025, shows a classic brand‑impersonation campaign targeting Solana users. The site presented the page title "SolDrop - Claim Your 15 SOL Airdrop", which aligns with the listed scam type "Fake Airdrop". No TLS certificate was observed, indicating the site was served over plain HTTP. DNS resolution points to 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States.

The domain uses Cloudflare name servers chip.ns.cloudflare.com and ophelia.ns.cloudflare.com, a common pattern for CDN‑based abuse. VirusTotal records indicate the domain was scanned by 95 security vendors without generating any detections; this absence of flags does not constitute a safety guarantee. The domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer, confirming that independent threat‑intel feeds have classified it as malicious. The site has been taken offline at the time of reporting, and the risk level remains "under investigation".

Current evidence does not reveal additional infrastructure such as command‑and‑control servers or credential‑harvesting endpoints, and the exact HTML content has not been captured. Defenders should continue to block the domain and its hosting IP at perimeter and DNS filtering layers, monitor for newly registered domains that reuse the "x-solana" pattern, and consider adding the associated Cloudflare name servers to watchlists for rapid‑deployment campaigns. The presence on two blocklists indicates early detection by community filters, and inclusion of the domain hash in internal threat‑intel repositories is advised. Ongoing telemetry collection, especially of any re‑activation attempts, will be required to determine whether the actors shift to alternative hosting or modify the airdrop lure.