sol-make[.]digital
“Claim Airdrop - Meteora”
Stored observation
Observed title contrast
Analysis indicates that the domain sol-make.digital is currently active and classified as a high‑risk brand‑impersonation campaign targeting Solana users. The site presents a page titled “Claim Airdrop – Meteora”, which aligns with the known Airdrop Scam kit. Infrastructure evidence shows the domain is hosted on an OVH SAS server (AS16276) located in Germany (IP 57.129.97.29). Both authoritative nameservers resolve to Cloudflare (clayton.ns.cloudflare.com, olga.ns.cloudflare.com), and the service is delivering traffic over HTTP/3. An HTTP 521 response suggests the origin server is unavailable, but the Cloudflare front‑end remains reachable.
The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming a valid HTTPS endpoint. Reputation data reports a Gridinsoft trust score of 0/100 and a single blocklist entry; the domain is actively blocked by PhishDestroy. VirusTotal scans have flagged the domain by 14 of 95 security vendors, reinforcing the malicious assessment. The registrar information points to SD‑onenetwork as the registrar, consistent with the ASN.
The risk level is explicitly marked as high, indicating urgent mitigation. No further public intelligence such as Safe Browsing or OTX is provided, leaving the broader campaign scope uncertain. Defenders should immediately add sol-make.digital and its resolved IP address to deny‑list rules, monitor for additional domains using the same Airdrop Scam kit, and consider tightening Cloudflare‑related alerts for newly registered domains under the same ASN. Continuous re‑evaluation is advised, as the site may become operational if the origin server is restored.
Threat Response Pipeline
Blocklist coverage
10 monitored external feeds · stored snapshot Aug 10, 2026
Detection timeline
Stored Capture
Domain Intelligence
Technical detailsDNS, TLS names and timestamps
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive