solana-giftdrop[.]com

solana-giftdrop.com was registered on 21 November 2025 through Tucows Domains Inc. The site is currently offline and was taken down by the PhishDestroy mitigation service. DNS resolution points to the IPv4 address 91.92.242.155, which is announced by AS202412 (Omegatech LTD) and geolocated to the Netherlands. The domain uses Cloudflare name servers annalise.ns.cloudflare.com and chris.ns.cloudflare.com, but no TLS certificate was observed during the scan, indicating traffic would be served over plain HTTP. The page title returned by the HTTP response is “Solana”, matching the claimed brand target of Solana. The infrastructure has been listed on a single security blocklist, and eight of ninety‑five VirusTotal scanners flagged the domain as malicious, reinforcing the suspicion of malicious intent.

Analysis of the available intelligence classifies the campaign as wallet/seed phishing, aiming to harvest private keys or seed phrases associated with Solana wallets. The combination of a recent registration, lack of encryption, a single‑blocklist entry, and multiple vendor detections suggests a short‑lived, targeted impersonation effort. The absence of an SSL certificate means that any credential submission would be transmitted without encryption, increasing the likelihood of credential capture. The single blocklist entry currently references the domain in the PhishDestroy feed, but additional threat‑intel platforms may not yet have ingested the indicator, so rapid sharing of the IOC is advised.

The eight vendor detections on VirusTotal include reputable scanners that identified the domain as hosting phishing‑related content, which aligns with the wallet/seed phishing label. The registrar information shows that Tucows Domains Inc. is the sponsoring registrar, a widely used service that does not inherently imply malicious intent but provides the attacker with a legitimate registration channel.