join-zeraonsol[.]xyz

This domain, join-zeraonsol.xyz, is flagged as a brand impersonation threat targeting the Solana cryptocurrency ecosystem. Analysis indicates the site presented itself as a "ZERA | Airdrop" platform, a common tactic to lure users into connecting wallets or submitting sensitive credentials under false pretenses. The domain appears designed to facilitate cryptocurrency theft, likely through a wallet-draining kit or phishing forms requesting seed phrases or private keys. Technical indicators confirm elevated risk. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to IP address 172.67.219.65, which is associated with Cloudflare infrastructure. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The site utilized HTTP/3 and Cloudflare technologies, which are frequently leveraged to obscure hosting origins and evade detection. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. The domain is currently offline, reducing immediate exposure to end users. However, residual risk persists due to the transient nature of phishing infrastructure. Users who interacted with the site may remain vulnerable to follow-up attacks, such as targeted phishing emails or malware distribution. Organizations and individuals are advised to monitor wallet addresses and credentials exposed to this domain, revoke any connected dApp permissions, and report the incident to relevant security teams for further mitigation. Proactive blocklisting of the domain and associated IP is recommended to prevent future access attempts.