tsw-ams3-solana-mainnet-fdval2[.]nodes[.]asymmetric[.]re

The domain tsw-ams3-solana-mainnet-fdval2.nodes.asymmetric.re was registered through GANDI and is currently offline. DNS resolution points to the IPv4 address 64.130.42.114, which belongs to the NL‑based ASN AS20326 operated by TeraSwitch Networks Inc. The authoritative name servers are ns-114-b.gandi.net, ns-228-c.gandi.net, and ns-244-a.gandi.net, matching the registrar’s infrastructure. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) is present, indicating that the site was served over HTTPS at the time of capture.

The only visible page title is “Firedancer | Asymmetric Research,” which does not directly reference the targeted brand but the domain is flagged as impersonating Solana in the intelligence feed. The threat is classified as a crypto‑scam, and the domain appears on a single security blocklist, where it is listed as blocked by PhishDestroy. VirusTotal analysis shows that one out of ninety‑five scanning engines flagged the domain, providing limited but corroborating evidence of malicious intent.

No additional content or visual artefacts have been captured, so the exact lure or payload employed by the site remains unknown. Defenders should add the IP address 64.130.42.114 and the full domain name to outbound and inbound filtering rules, monitor GANDI name‑server activity for any re‑activation, and keep the domain on threat‑intel watchlists. Continuous observation of blocklist updates and future VirusTotal scans is recommended to capture any changes in detection posture.