main-solan[.]biz

The domain main-solan.biz was identified as a brand impersonation scam specifically targeting cryptocurrency users through a fraudulent airdrop scheme. The site masqueraded as a legitimate Solana (SOL) airdrop portal, luring victims with the promise of 15 SOL tokens under the page title 'SolDrop - Claim Your 15 SOL Airdrop.' This type of threat is classified as a brand impersonation scam, designed to deceive users into interacting with malicious smart contracts or disclosing private keys. As of the latest analysis, the domain has been taken offline, though its infrastructure remains a documented threat vector. Infrastructure analysis reveals critical technical indicators associated with this campaign. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 25, 2026, an unusually future-dated registration that may indicate an attempt to evade immediate scrutiny. It resolved to the IP address 172.67.178.68, a Cloudflare-associated endpoint often leveraged to obscure hosting origins. Detection metrics show that 9 of 95 security vendors on VirusTotal flagged the domain as malicious, while it also appeared on one security blocklist. The SSL certificate was issued by Let's Encrypt (serial number E8), a common but not inherently suspicious provider, though its use in this context aligns with observed patterns in phishing infrastructure. Current status indicates the domain is offline, reducing immediate risk to end users. However, the technical indicators and registration patterns suggest this was part of a broader, potentially recurring campaign. Users are advised to treat any future domains with similar naming conventions (e.g., 'sol-drop,' 'sol-airdrop') or identical page titles as high-risk. Wallet interactions with such sites should be avoided, and any claims of token airdrops should be verified through official project channels. Network-level protections, such as DNS filtering or endpoint detection rules referencing the IP 172.67.178.68, may mitigate residual exposure. Organizations should monitor for related domains registered under the same registrar or resolving to overlapping infrastructure.