airsol[.]io

This domain, airsol.io, was registered on October 1, 2025, and is flagged as a brand impersonation targeting Solana, specifically delivering a fake airdrop scam. The page title, 'SolDrop - Claim Your 15 SOL Airdrop,' directly references Solana cryptocurrency, indicating an attempt to deceive users into engaging with fraudulent airdrop claims. The domain is currently offline, but infrastructure analysis reveals it previously resolved to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare's network (AS13335) in the US. Nameservers are aldo.ns.cloudflare.com and fish.ns.cloudflare.com, consistent with Cloudflare-protected domains.

No SSL certificate was detected, which may have contributed to its detection by security vendors. The domain appears on one security blocklist, and two of 95 security vendors on VirusTotal flagged it as malicious. The registrar is Web Commerce Communications Limited, and the scam type is classified as a fake airdrop. Gridinsoft assigns a trust score of 11/100, reflecting its high-risk status.

Defenders should treat this domain as part of a broader campaign targeting cryptocurrency users, particularly those associated with Solana. While the domain is offline, monitoring for re-registration or similar domains using the same naming pattern ('SolDrop' or 'SOL airdrop') is recommended. No additional payloads or redirect chains are confirmed, but the phishing kit is identified as an 'Airdrop Scam,' suggesting a focus on credential or wallet seed phrase theft. Further analysis of related infrastructure, such as hosting IPs or nameservers, may reveal additional connected domains.