# PhishDestroy threat dossier — soldiers.solcoin.info ================================================================ Fetched: 2026-07-24 09:43:27 UTC Canonical: https://phishdestroy.io/domain/soldiers.solcoin.info/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Fake Airdrop Targeted brand: Airdrop Scam Phishing kit: Airdrop Scam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: ["elle.ns.cloudflare.com", "gerald.ns.cloudflare.com"] Page title: SOLdiers | Airdrop ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-18 Status: INVALID chain Fingerprint: f25f8fd7344214a5041d7ab40d3a8b9a922b8c70db0cfb9907d80cd64d63385a Subject Alternative Names (related infrastructure — often same operator): - solcoin.info ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-21 04:34:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-24 08:20:21 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f8285-1d3f-711d-a9d2-d8c9030965ed/ Wayback Machine: https://web.archive.org/web/*/soldiers.solcoin.info crt.sh CT logs: https://crt.sh/?q=%25.soldiers.solcoin.info Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=soldiers.solcoin.info AlienVault OTX: https://otx.alienvault.com/indicator/domain/soldiers.solcoin.info URLhaus: https://urlhaus.abuse.ch/host/soldiers.solcoin.info/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-21 04:34:42 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] soldiers.solcoin.info: Confirmed Phishing Site Analysis of soldiers.solcoin.info as of July 21, 2026 indicates that the domain is actively used for phishing. The DNS resolution returns the IPv4 address 188.114.97.3. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. No authoritative name server records were returned during the query, which may indicate misconfiguration or intentional concealment of hosting details. VirusTotal reports that the domain has been scanned by 95 antivirus and URL‑reputation engines; none of the engines raised a detection, but the absence of a flag does not constitute evidence of benign behavior. The hosting provider for 188.114.97.3 is not identified in the supplied data, and no ASN, country, or SSL certificate information is available. HTTP response details, page title, and Safe Browsing status are also missing, limiting the ability to confirm the content served by the site. Because the domain currently lacks a published registrar record in the intelligence set, its registration date and owner remain unknown. Given the confirmed blocklist entry, the active status, and the fact that PhishDestroy has taken mitigation action, the domain should be treated as a confirmed phishing vector until further forensic evidence can be collected. Defensive recommendations include adding the domain and its resolved IP address to network‑level deny lists, updating web‑proxy and DNS filtering rules to block any resolution of soldiers.solcoin.info, and monitoring outbound traffic for connections to 188.114.97.3. Security teams should also consider querying additional intelligence sources such as OTX, Google Safe Browsing, and SSL Labs to obtain missing certificate and reputation data. Continuous re‑evaluation is advised, as the domain’s infrastructure may evolve or new detection signatures may appear. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: f25f8fd7344214a5041d7ab40d3a8b9a922b8c70db0cfb9907d80cd64d63385a ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/soldiers.solcoin.info/ JSON API: https://api.destroy.tools/v1/check?domain=soldiers.solcoin.info Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 189,173 domains (58,600 alive under monitoring, 128,955 confirmed takedowns/dead). Site: https://phishdestroy.io