copeonsolana[.]com

Analysis as of July 24 2026 indicates that the domain copeonsolana.com was registered on August 29 2025 via NiceNIC International Group Co., Limited. The authoritative nameservers julissa.ns.cloudflare.com and valentin.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.84.6, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented for the host, and an HTTP request returns no active service because the site is currently taken offline. The page title that was observed prior to takedown reads "Welcome to $COPE", and the domain has been classified as a crypto‑related scam impersonating the Solana brand.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a highly malicious profile. Independent blocklists PhishDestroy and ScamSniffer have already listed the domain, and two additional security blocklists contain the same indicator. VirusTotal analysis shows that four out of ninety‑five scanning engines flagged the domain as malicious, reinforcing the detection consensus. The combination of brand impersonation, lack of SSL, low trust score, and multiple blocklist entries suggests that the infrastructure was intentionally crafted to lure victims interested in Solana‑related cryptocurrency activities.

At present, the exact payload or phishing flow has not been publicly released, and no further technical artifacts such as downloadable binaries or credential‑harvesting forms have been captured. Defenders should continue to deny any network traffic to 104.21.84.6, add copeonsolana.com to local and upstream DNS blocklists, and monitor for any resurgence of the domain or similar domains registered by the same registrar. Ongoing observation of Cloudflare‑hosted IP ranges for new domains that reference Solana or use the "$COPE" branding is recommended to pre‑empt future campaigns.