seeker-dzv[.]pages[.]dev

The domain seeker-dzv.pages.dev was registered on March 22, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.47.9 located in Canada. The authoritative nameservers are salvador.ns.cloudflare.com and ziggy.ns.cloudflare.com, both Cloudflare‑managed, confirming that the site is hosted behind Cloudflare’s edge network. TLS is provided by Google Trust Services under the WE1 certificate, and the site advertises HSTS and HTTP/3, indicating a modern HTTPS configuration. An HTTP request to the site returns a 403 status, and the domain has been taken offline, with the block action recorded by PhishDestroy.

The page title observed before takedown, "SKR Airdrop Claim | Solana Mobile," aligns with a known airdrop‑scam kit that impersonates the Solana brand, and the threat classification is a fake airdrop used for brand impersonation. VirusTotal scans show five of ninety‑four security vendors flag the domain, and it appears on a single external blocklist, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing its malicious reputation. The evidence points to a targeted attempt to lure Solana users into a fraudulent airdrop claim, leveraging a legitimate‑looking page title and brand reference. Uncertainty remains around the exact payload delivered to victims, as the site content was not captured before removal, and no additional indicators such as malicious URLs or payload hashes have been disclosed.

Defenders should update web filtering rules to block the fully qualified domain name, monitor for similar Cloudflare‑hosted subdomains that reference Solana or airdrop terminology, and incorporate the observed SSL certificate and IP address into threat‑intel feeds. Incident response teams should also advise users to disregard unsolicited Solana airdrop communications and verify any token distribution through official Solana channels.