solscantools[.]xyz

Analysis of solscantools.xyz indicates a confirmed brand‑impersonation infrastructure targeting the Solana ecosystem. The domain was registered on September 12, 2024 through Go Daddy, LLC and uses the default GoDaddy nameservers ns21.domaincontrol.com and ns22.domaincontrol.com. It resolves to IP address 185.199.109.153, which is owned by Fastly, Inc. (AS54113) and geolocated to the United States. No SSL certificate is present, meaning all traffic would be unencrypted if the site were reachable.

The page title returned by the server, "Sol Scan Bot," aligns with the documented scam type of a crypto scam and reinforces the intent to mimic legitimate Solana services. VirusTotal analysis shows that one out of ninety‑five security vendors flagged the domain, providing a minimal but tangible indication of malicious behavior. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one trusted anti‑phishing source has recognized it as harmful. Gridinsoft’s trust scoring system assigns a 0 / 100 rating, reflecting an extreme lack of reputation.

Current network status is offline, and the site does not return an active HTTP response. Nevertheless, the combination of brand impersonation, a low trust score, a flagged vendor detection, and inclusion on an active blocklist classifies the domain as elevated risk. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor the associated IP for any re‑activation, and watch for new subdomains that may be created under the same registrar. Incident response teams should also consider adding the domain to internal threat intel repositories and share the indicator with broader threat‑sharing communities to prevent collateral victimization.