sol-collect[.]net

This domain, sol-collect.net, is identified as a brand impersonation threat targeting the Solana cryptocurrency ecosystem. Analysis confirms the domain was designed to deceive users by masquerading as an official Solana platform, specifically promoting a fraudulent SOL airdrop under the page title 'Solana - Claim Your SOL Airdrop.' The domain is currently offline, though its prior activity poses residual risks to users who may have interacted with it during its operational phase. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.194.199, hosted on AS13335 Cloudflare, Inc., a network commonly leveraged to obscure malicious infrastructure. Security vendors flagged the domain in 10 of 95 VirusTotal scans, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's fraudulent nature, as threat actors routinely abuse legitimate certificate authorities to lend credibility to phishing sites. The domain's current offline status reduces immediate exposure, but historical data suggests it was actively used to harvest credentials or distribute malicious payloads. Organizations and users are advised to treat any prior interactions with sol-collect.net as compromised. Network administrators should block the domain and its associated IP (172.67.194.199) at the firewall level. Cryptocurrency platforms, particularly those in the Solana ecosystem, should issue warnings to users about this specific threat vector. Continuous monitoring for related domains or IPs is recommended, as threat actors often re-deploy infrastructure under similar naming conventions.