oillessonsol[.]lol

The domain oillessonsol.lol is identified as a brand impersonation threat targeting the Solana cryptocurrency platform. Analysis indicates the site is designed to deceive users by masquerading as an official Solana airdrop or promotional event, a common tactic to distribute crypto drainers or harvest credentials. The domain is currently offline, but prior activity and infrastructure details confirm its malicious intent.

Technical indicators reveal the domain was flagged by 13 of 95 security vendors on VirusTotal, a notably elevated detection rate for a phishing site. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 9, 2026, a registrar frequently associated with high-risk domains. The domain resolved to IP address 172.67.169.81, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to conceal the true origin of malicious infrastructure. The page title, 'OILLESS | Airdrop,' further supports the impersonation of Solana-related promotions. The domain appears on one security blocklist, and it was preemptively blocked by at least one threat intelligence feed prior to takedown.

Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and registration patterns suggest the operators may re-emerge under a similar domain. Users are advised to verify all Solana-related promotions through official channels only. Wallet connections or login attempts on unverified sites should be treated as high-risk. Security teams should monitor for domains registered through the same registrar or resolving to similar Cloudflare-hosted IPs, as these may indicate follow-up campaigns. Blocking the observed IP and domain at network perimeters is recommended for proactive defense.