sol-fdusd[.]shop

The domain sol-fdusd.shop was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolved to the IP address 104.21.89.91, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The site employed Cloudflare’s edge services, including HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid‑looking HTTPS configuration. The page title returned by the server was "TokenPocket × Solana | USDT 挖矿平台," linking the content to a purported USDT mining platform and explicitly mentioning the Solana brand. The intelligence classifies the activity as a crypto scam that impersonates Solana, aligning with the broader threat of brand impersonation aimed at cryptocurrency users.

VirusTotal analysis recorded five detections out of ninety‑five scanners, confirming that multiple security vendors flag the domain as malicious. The domain appears on a single public blocklist and has been added to PhishDestroy’s blocklist, reinforcing its malicious reputation. Current infrastructure status is offline, which may indicate temporary takedown or re‑hosting attempts. Defenders should treat any traffic to sol-fdusd.shop as suspicious; firewall or proxy rules should block the domain and its associated IP range (104.21.89.91) as well as the Cloudflare nameservers jacob.ns.cloudflare.com and janet.ns.cloudflare.com.

Monitoring for new subdomains or similar domains registered through the same registrar is advisable, as threat actors often reuse registration services. Because the site leveraged a legitimate TLS certificate, traditional certificate inspection will not reveal the abuse, so reliance on threat‑intel feeds and domain reputation services is essential. Continuous review of detection vendor updates is recommended to capture any changes in the domain’s malicious status. The combination of brand impersonation, a crypto‑focused page title, and multiple vendor detections makes sol-fdusd.