soldao[.]today

Analysis of soldao.today, observed as a social‑media phishing site that impersonates Discord, shows a recent infrastructure setup. The domain was registered on 28 August 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.97.3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The TLS certificate presented is labeled WE1, and the only publicly visible page title is “Solana”, a mismatch that suggests the site may be attempting to lure victims with unrelated cryptocurrency terminology. Scamadviser assigns a trust score of 36 / 100, while Gridinsoft rates the domain at 0 / 100, reflecting a low reputation across commercial rating services. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

VirusTotal analysis records detections from 2 of 93 scanning engines, confirming that at least a subset of security products recognize malicious activity. The site is currently taken offline, but the underlying hosting on a shared Cloudflare edge could be re‑activated quickly. Defenders should treat soldao.today as a confirmed Discord impersonation vector. Immediate mitigation steps include adding the domain to DNS‑based blocklists, firewall deny lists, and email gateway filters.

Monitoring of the associated IP 188.114.97.3 for any resurgence of activity is advisable, as Cloudflare edge nodes can host multiple malicious domains. Because the page title does not correspond to the advertised brand, threat hunters should also watch for other domains that reuse the “Solana” title while targeting Discord users. Regularly updating threat‑intel feeds with the current blocklist identifiers and VirusTotal detection IDs will help maintain coverage. Until the domain remains offline, no further technical details such as login form structure or payload delivery are available, so continuous observation is required to capture any re‑deployment.