vel-fra1-solana-mainnet-fdval4[.]nodes[.]asymmetric[.]re

This domain, vel-fra1-solana-mainnet-fdval4.nodes.asymmetric.re, is currently under investigation for brand impersonation targeting Solana, a cryptocurrency platform. Analysis indicates the domain is active, returning an HTTP 200 status, and resolves to the IP address 85.195.110.15, hosted under AS29066 (velia.net Internetdienste GmbH) in Germany. The page title, 'Firedancer | OtterSec,' suggests an attempt to mimic legitimate Solana-related services, though the exact content and functionality of the site remain unconfirmed due to limited visibility into its operations. Infrastructure details reveal the domain is registered through GANDI and uses nameservers ns-114-b.gandi.net, ns-228-c.gandi.net, and ns-244-a.gandi.net. The SSL certificate is issued by Let's Encrypt (serial number E8), which is consistent with both legitimate and malicious domains. As of July 12, 2026, the domain appears on one security blocklist, specifically PhishDestroy, but has not yet been flagged by any of the 95 engines on VirusTotal. This lack of detection does not confirm safety, as new or low-prevalence threats often evade initial scans. The domain is classified as a cryptocurrency scam, though the specific mechanics—such as whether it operates as a wallet drainer, fake exchange, or credential harvester—are not yet documented. Defenders should treat this domain as high-risk due to its association with brand impersonation and cryptocurrency fraud. Immediate actions include blocking the domain and its resolving IP (85.195.110.15) at the network perimeter, monitoring for internal connections to this infrastructure, and correlating logs for any user interactions with the site. Further analysis, such as sandboxing or manual inspection, is recommended to determine the exact payload or deception tactics employed.