flowhold[.]fun

This domain is flagged for brand impersonation targeting Dexscreener, a platform for decentralized exchange analytics. The specific threat involves distributing fraudulent Solana token airdrops, likely designed to harvest user credentials or compromise cryptocurrency wallets through malicious smart contract interactions. Analysis indicates an elevated risk level due to the domain's active impersonation of a trusted cryptocurrency tool and its presence on multiple security blocklists. Infrastructure analysis reveals the domain flowhold.fun was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.97.3 and is currently offline. The domain appears on 5 security blocklists, including MetaMask, ScamSniffer, SEAL, PhishDestroy, and Maltrail. VirusTotal reports 3 out of 95 security vendors flagging this domain as malicious, while Gridinsoft assigns a trust score of 0/100. The page title, 'Airdrop Live | Claim Solana Token Airdrops,' directly mimics legitimate airdrop campaigns to deceive users. Mitigation steps for this threat type include blocking the domain and its associated IP (188.114.97.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to flowhold.fun and similar impersonation domains. Users should be educated to verify domain authenticity before interacting with airdrop claims, particularly those involving cryptocurrency wallets. Monitoring for additional domains registered through the same registrar (PDR Ltd.) with similar naming patterns may help identify related threats. Cryptocurrency platforms should implement additional verification steps for airdrop-related transactions to prevent unauthorized access.