koltracking[.]com

koltracking.com was registered on April 10, 2026 through Cloudflare, Inc. and currently resolves to the Cloudflare edge address 104.21.17.212, located in the United States under AS13335. The domain serves a page titled “KOL Tracking — Auto‑Trade Solana on KOL Signals | 493 Wallets Tracked”, which explicitly references the Solana brand and suggests automated trading services. The site returns HTTP 200 and presents a valid Let’s Encrypt certificate (YE1), indicating that the operators have taken basic steps to appear trustworthy. The authoritative nameservers aaron.ns.cloudflare.com and alla.ns.cloudflare.com are standard Cloudflare DNS endpoints, offering no direct insight into the underlying hosting environment. The use of Cloudflare’s reverse‑proxy and CDN services masks the true origin server, a common technique for phishing operators seeking to hide attribution. The low Gridinsoft trust score of 0/100 and the fact that the domain appears on a security blocklist further corroborate malicious intent. Open‑source intelligence flags koltracking.com in two AlienVault OTX pulses, and three of ninety‑five VirusTotal scanners have raised detections, demonstrating that independent analysis tools have begun to catalog the site as suspicious. PhishDestroy already blocks the domain, and the brand‑impersonation classification aligns with the page’s overt use of Solana branding and the promise of “auto‑trade” functionality, a classic lure for credential harvesting or transaction manipulation. Defenders should immediately add koltracking.com to URL and DNS blocklists, monitor outbound connections to the 104.21.17.212 address, and enforce strict content‑security policies that prevent unauthenticated script execution from this host. Continuous threat‑intel feeds should be consulted for any updates to the domain’s detection history, and organizations employing Solana‑related services should issue user alerts warning against unsolicited trade offers originating from this domain.