sol-token-feed[.]com

The domain sol-token-feed.com was registered on 21 February 2026 through Web Commerce Communications Limited and is hosted on Cloudflare infrastructure (ASN 13335). DNS resolution points to the IPv6 address 2a06:98c1:3120::3, which is geolocated to the United States. The site employed a Google Trust Services certificate (WE1) and served content over HTTP/3, indicating a modern web stack. When accessed, the server responded with HTTP 404 and the page title reported as “$CANCER Airdrop”, a pattern commonly associated with cryptocurrency airdrop scams.

VirusTotal scans show that two of ninety‑three security vendors flagged the domain, and it is listed on at least one external blocklist, with PhishDestroy confirming the site as malicious. The domain is presently taken offline, which limits immediate interaction but does not remove the underlying infrastructure or the potential for re‑activation. Current evidence classifies the site as a crypto‑related scam, specifically an airdrop lure, though the exact payload or victim‑interaction flow remains unknown because the content was not captured before takedown. Defenders should continue to block the domain at network perimeter, update DNS‑filtering lists, and monitor the associated IPv6 address for any future activation.

Additional scrutiny of the two vendors that raised alerts on VirusTotal may reveal indicator patterns useful for broader detection. Because the domain uses Cloudflare’s shared services, similar malicious sites may share the same nameservers (buck.ns.cloudflare.com, natasha.ns.cloudflare.com); security teams should consider expanding monitoring to other domains resolved to the same resolver set. Ongoing observation of the registrar and any new registrations that reuse the same registrar or naming conventions is advisable to pre‑empt repeat campaigns.