solan-take[.]org

Analysis on solan-take.org shows that the domain was registered on 27 January 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP 104.21.81.203, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Cloudflare front‑end services are frequently leveraged to hide malicious infrastructure, making attribution of the underlying server difficult. The site presented a page titled “SolDrop – Claim Your 15 SOL Airdrop,” directly referencing Solana’s native token and implying a free giveaway. This aligns with the reported scam type of a crypto‑airdrop fraud and the identified phishing kit labeled “Airdrop Scam.” The domain is flagged by three of ninety‑three VirusTotal scanners, indicating that a minority of security vendors have detected malicious behavior.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the suspicion of abuse. The domain appears on one public security blocklist and has been blocked by PhishDestroy, confirming that at least one defensive feed considers it malicious. The SSL certificate is listed as “WE1,” which does not correspond to a known trusted certificate authority and may be a self‑signed or otherwise low‑trust certificate. The domain is currently offline, but historical evidence suggests it was used to impersonate the Solana brand and lure victims into claiming a non‑existent 15 SOL airdrop.

No additional intelligence such as malware hashes, command‑and‑control endpoints, or victim reports is publicly available, leaving the full scope of the campaign uncertain. Defenders should continue to block the domain, monitor for DNS resolutions to the same Cloudflare IP range, and add related indicators to email and web filters. Organizations that hold Solana assets should educate users about unsolicited airdrop offers and enforce verification of official communication channels.