sol-farming[.]xyz

Analysis of the domain sol-farming.xyz indicates it was actively involved in a wallet and seed-phishing campaign targeting users of the Solana blockchain. The domain, registered on September 6, 2025, through Dynadot LLC, resolved to the IP address 198.251.88.188, hosted by FranTech Solutions (AS53667) in the United States. Infrastructure analysis reveals the use of nameservers ns7.asurahosting.com and ns8.asurahosting.com, a common pattern in low-reputation hosting setups. The page title, 'Solana Airdrop (Devnet),' explicitly suggests an attempt to deceive users into believing they are interacting with an official Solana development network airdrop, a known vector for phishing attacks. As of the report date, the domain has been flagged by five security vendors on available detection platforms, though the absence of a VirusTotal scan in the provided intelligence precludes a full assessment of broader detection coverage.

The domain appears on five security blocklists and is specifically blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, indicating prior identification as malicious. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk. No SSL certificate was detected, a red flag for user security, particularly in financial or cryptocurrency-related scams. The scam type is classified as a wallet/seed phishing operation, consistent with the 'Airdrop Scam' phishing kit referenced in the intelligence.

While the exact content of the phishing page remains unanalyzed, the combination of the page title, brand impersonation of Solana, and the use of a known phishing kit strongly suggests an intent to harvest cryptocurrency wallet credentials or seed phrases. Defenders are advised to treat this domain as compromised and maintain its presence on blocklists. Network-level protections should be implemented to prevent resolution of the domain and its associated IP address.