soldrop[.]w3claim[.]xyz

The domain soldrop.w3claim.xyz was registered on February 21, 2026 and is currently offline, but historical telemetry indicates it was used to impersonate Coinbase in a crypto‑related giveaway scheme. The site presented a page titled “Solana Devnet Faucet – Airdrop SOL”, aligning with the known Airdrop Scam phishing kit. Infrastructure analysis shows the domain resolved to IP address 206.217.128.210, hosted in the United States under ASN 36352 (HostPapa). The SSL certificate associated with the host is identified as R11, providing no indication of legitimate certificate authority usage.

Reputation services rate the domain extremely poorly, with Scamadviser assigning a trust score of 1 / 100 and Gridinsoft a score of 4 / 100. Detection platforms have flagged the domain: PhishDestroy and ScamSniffer list it as blocked, and it appears on two additional security blocklists. VirusTotal scans returned six positive detections out of ninety‑three vendors, confirming malicious classification. The threat is categorized as a crypto scam targeting Coinbase users, leveraging the “Airdrop Scam” kit to lure victims with promises of free SOL tokens.

Defenders should add the domain and its resolving IP to blocklists, monitor for any re‑use of the same hosting provider or IP range, and enforce outbound filtering for the “solana devnet faucet” keyword pattern. Because the site is offline, active takedown is not possible, but continuous observation of HostPapa‑hosted assets is advised to catch potential redeployments. Organizations should educate users about unsolicited airdrop offers, especially those referencing Coinbase, and ensure that security solutions incorporate the observed indicators of compromise to prevent future exposure.