claims-solan[.]org

This domain, claims-solan.org, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 172.67.196.126 (AS13335, United States). The authoritative nameservers are gracie.ns.cloudflare.com and quinton.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s edge network. TLS inspection shows a certificate issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS certificate.

Network traffic was observed over HTTP/3, consistent with modern Cloudflare deployments. The landing page title returned by the server is "SolDrop - Claim Your 15 SOL Airdrop", which aligns with the documented scam type of a fake cryptocurrency airdrop and the impersonated brand Solana. VirusTotal scans report that ten of ninety‑three anti‑malware engines flagged the domain as malicious, and the domain is listed on two public blocklists, with active takedown actions by PhishDestroy and ScamSniffer.

As of the report date (24 July 2026) the site is offline, but the underlying hosting and certificate remain active. Defenders should continue to block the domain at perimeter and endpoint layers, monitor the associated IP range for any re‑activation, and add the observed nameserver pair to threat‑intel feeds. Additional analysis is needed to determine whether the site ever hosted credential‑harvesting forms or redirected victims to secondary payload sites, as the current evidence is limited to registration, infrastructure, and title metadata.