solrulet[.]life

Analysis of the domain solrulet.life indicates it was actively impersonating the Solana blockchain platform to conduct a fraudulent airdrop scheme. Registered through Cloudflare, Inc., the domain resolved to IP address 57.129.97.29, hosted on OVH SAS infrastructure (AS16276) in Germany. The page title, 'Claim Airdrop - Meteora,' suggests an attempt to deceive users into believing they were interacting with a legitimate token distribution event, specifically targeting the Meteora protocol or a similarly named project within the Solana ecosystem. The domain was flagged by at least one security blocklist and assigned a trust score of 0/100 by Gridinsoft, reflecting high confidence in its malicious nature.

Two of 95 security vendors on VirusTotal detected the domain as malicious, though the absence of detections from other vendors does not imply safety. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data. Nameservers byron.ns.cloudflare.com and dolly.ns.cloudflare.com were configured, consistent with Cloudflare's registrar services. Infrastructure analysis reveals the domain was taken offline following detection, though its prior operational status and the exact duration of activity remain unclear.

The scam type is classified as a fake airdrop, a common tactic to harvest cryptocurrency wallet credentials or private keys. Defenders should treat this domain as part of a broader campaign targeting Solana users and monitor for related infrastructure, including similarly named domains or reused IP addresses. Network-level blocking of 57.129.97.29 and associated nameservers is recommended for organizations seeking to prevent access to residual or resurrected phishing endpoints. Further investigation into the phishing kit, labeled 'Airdrop Scam,' may reveal additional indicators of compromise or campaign linkages.