drops[.]sol-community[.]cc

Analysis of drops.sol-community.cc, observed on July 24, 2026, shows a brand‑impersonation infrastructure targeting the Solana ecosystem. The domain was created on February 21, 2026 and currently resolves to 172.67.141.243, an IP address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented the page title "Solana" and employed an SSL certificate identified as WE1, indicating that TLS was active at the time of collection. VirusTotal scans returned six detections out of ninety‑five scanners, reinforcing the malicious classification.

Gridinsoft assigned a trust score of 0 / 100, and the domain appears on one external blocklist, PhishDestroy, which has already taken the host offline. The known intelligence tags the operation as a crypto scam and specifies that the domain impersonates the Solana brand. No additional evidence of a phishing kit, login page, or payload was captured, and public Safe Browsing or OTX feeds do not reference the host.

Uncertainty remains regarding the exact content delivered to victims and whether the infrastructure will be reused under a different domain or sub‑domain. Defenders should immediately block the domain and its associated IP address, monitor Cloudflare‑owned ranges for re‑registration of similar identifiers, and incorporate the observed indicators—creation date, SSL fingerprint, VirusTotal detection count, and Gridinsoft score—into threat‑intel feeds. Continuous re‑assessment is advised in case the actor revives the site or shifts to alternative hosting services.