1co1n-sol[.]com

Analysis indicates that the domain 1co1n-sol.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and currently resolves to IP 104.21.91.98, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain uses the nameservers aria.ns.cloudflare.com and kayden.ns.cloudflare.com and presents a TLS certificate issued by Google Trust Services under the WE1 profile. HTTP requests return a 301 redirect and the site advertises the title “1 Coin”. Automated scanners have flagged the domain as a crypto scam impersonating the Solana brand; eight of ninety‑three VirusTotal scanners have raised detections and the domain appears on four public blocklists, including PhishDestroy, MetaMask, SEAL and ScamSniffer. The Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment. Infrastructure analysis shows only Cloudflare and HTTP/3 as identified technologies, providing limited insight into the payload. No additional content has been observed, so the exact phishing page layout and credential‑capture mechanisms remain unknown. Defenders should immediately block DNS and HTTP traffic to 1co1n-sol.com, add the IP address 104.21.91.98 to network deny lists, and ensure that URL filtering solutions incorporate the known blocklist identifiers. Continuous monitoring for new subdomains or changes in the SSL certificate is recommended, as the attacker may pivot to additional infrastructure while the current domain remains active.