# PhishDestroy threat dossier — sol.cryptodrop.xyz ================================================================ Fetched: 2026-05-14 05:01:46 UTC Canonical: https://phishdestroy.io/domain/sol.cryptodrop.xyz/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Solana Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, CRDF, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Netcraft, Sophos, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Registrar of Domain Names REG.RU, LLC Nameservers: ["cora.ns.cloudflare.com", "justin.ns.cloudflare.com"] Registered: 2026-03-30 Page title: Solana ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-06-22 Status: INVALID chain Fingerprint: 45bec6bafd887beb9083b235b1d1023a89cc79f506dd2e776ee715e43e66b197 Subject Alternative Names (related infrastructure — often same operator): - cryptodrop.xyz ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-03-30 03:44:34 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-03-30 00:45:27 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-05-07 07:40:25 UTC Neutralised: 2026-04-23 05:05:49 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d3c32-b8e6-74e4-8e7a-1e5db9514e9e/ URLQuery: https://urlquery.net/report/76257edb-e9d1-4f09-9d59-2f195dc8a496 Wayback Machine: https://web.archive.org/web/*/sol.cryptodrop.xyz crt.sh CT logs: https://crt.sh/?q=%25.sol.cryptodrop.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=sol.cryptodrop.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/sol.cryptodrop.xyz URLhaus: https://urlhaus.abuse.ch/host/sol.cryptodrop.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-30 03:45:05 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies sol.cryptodrop.xyz as an active cryptocurrency-themed phishing domain designed to deceive users into surrendering sensitive wallet credentials or transferring digital assets. The domain mimics legitimate cryptocurrency service interfaces, such as wallet interfaces or exchange portals, to exploit trust and facilitate theft. Analysis confirms this is not a legitimate service but an impersonation attempt aimed at harvesting private keys or initiating unauthorized transactions. This domain was flagged with 0 detections out of 95 VirusTotal engines, indicating no prior recognition by automated security systems despite its recent creation on February 12, 2026. The infrastructure is hosted on IP 188.114.96.3 and utilizes a Let’s Encrypt SSL certificate to appear legitimate. The domain is registered through Registrar of Domain Names REG.RU LLC, a common provider used by malicious actors due to low registration friction and minimal oversight. These technical indicators suggest an emerging threat undergoing active evasion tactics. Users who have visited or interacted with sol.cryptodrop.xyz should immediately cease all communication and cease any attempted login or transaction activities. If credentials were entered, assume compromise: revoke all API keys, rotate wallet passwords, and transfer funds to a newly generated wallet address under secure control. Report the domain to your security team or via platforms like URLScan, PhishTank, or your local CERT. Block the domain at network level (DNS sinkholing) and inspect endpoint logs for signs of compromise, such as unauthorized wallet connection attempts or data exfiltration to C2 infrastructure hosted on 188.114.96.3. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260330-0F95E1 Favicon MD5: ffab4ba2c2132c554cb29bd4b783cc31 TLS cert SHA-256: 45bec6bafd887beb9083b235b1d1023a89cc79f506dd2e776ee715e43e66b197 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/sol.cryptodrop.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=sol.cryptodrop.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,039 domains (31,194 alive under monitoring, 117,156 confirmed takedowns/dead). Site: https://phishdestroy.io