lmao-on-sol[.]com

The domain lmao-on-sol.com is currently active and was registered on February 21 2026 through MAT BAO CORPORATION. Its authoritative name servers are gloria.ns.cloudflare.com and quincy.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution returns the IPv6 address 2606:4700:3037::6815:2ed6, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presents the page title “$LMAO Airdrop”, and the SSL certificate is issued by Google Trust Services under the WE1 intermediate, suggesting a valid TLS chain but offering no assurance about the underlying content. VirusTotal records show that 2 of 93 security vendors have flagged the domain, and it appears on a single external blocklist.

PhishDestroy has also added the domain to its blocklist. The HTTP response code is 525, indicating an SSL handshake failure at the origin server, which may be caused by misconfiguration or intentional disruption. Detected technologies include Cloudflare’s CDN and HTTP/3 support. The evidence points to a high‑risk brand‑impersonation campaign targeting users of the Solana ecosystem, likely attempting to lure victims with a fraudulent airdrop offering.

However, the specific payload, credential‑capture mechanism, or monetary loss vector has not been observed in the current intelligence set, leaving the exact attack flow uncertain. Defenders should block DNS resolution for lmao-on-sol.com at the network perimeter, add the domain and its associated IPv6 address to proxy and firewall deny lists, and monitor for any outbound connections to Cloudflare‑served resources that reference the “$LMAO Airdrop” string. Endpoint detection policies should be tuned to alert on processes that invoke browsers or scripts with URLs matching the domain pattern. Continuous re‑evaluation is advised, as the 525 status may change if the operators correct the TLS configuration, potentially enabling further malicious activity.