soldrop[.]solvault[.]ws

On July 25, 2026, the domain soldrop.solvault.ws was observed in an elevated‑risk brand‑impersonation campaign targeting the Solana ecosystem. The domain was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the IPv6 address 2606:4700:3032::6815:4209, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. VirusTotal analysis shows that four of ninety‑three security vendors flagged the domain, indicating partial detection across the vendor ecosystem.

The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. The TLS certificate presented by the site is identified as “WE1”, which does not correspond to a recognized certificate authority and is typical of quickly‑issued certificates used by malicious actors. The HTTP response returned a page title of “Solana”, confirming that the adversary intended to impersonate the Solana brand, consistent with the classification of a crypto‑scam campaign. No additional content or page‑behavior details have been published, leaving the exact phishing vector (e.g., credential harvesting, wallet address substitution) unverified.

Defenders should prioritize adding the domain to URL filtering and DNS blocklists, enforce TLS inspection to detect the WE1 certificate, and monitor Cloudflare‑associated address space for similar impersonation attempts. Continuous re‑scanning with multi‑vendor platforms is recommended to capture any future changes in detection status. Organizations handling Solana‑related assets should educate users about unsolicited links referencing soldrop.solvault.ws and consider implementing domain‑based allow‑lists that exclude untrusted subdomains.