copy-reconnecting[.]pro

On 24 July 2026 analysis flagged the domain copy-reconnecting.pro as a malicious infrastructure targeting Solana users. The site presented the page title “Web3 Portal for Everyone | Airdrops, Bitcoin, Solana, Mantle, Crypto and More.” indicating an airdrop‑style lure. VirusTotal recorded three positive detections out of ninety‑five scanners, confirming that at least a subset of security products consider the host malicious. The domain resolves to IP 45.12.114.40, which belongs to the Russian AS33993 network operated by UFO Hosting LLC. Nameserver records point to ns1.desec.io and ns2.desec.org, typical of fast‑changing hosting services.

No TLS certificate was observed, meaning the site served content over plain HTTP only. The infrastructure has been listed on four independent blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt and Codeesura. Gridinsoft assigned a trust score of 0/100, reflecting a complete lack of reputation. The observed kit matches a known “Airdrop Scam” template commonly used to impersonate cryptocurrency projects, and the brand target is explicitly identified as Solana.

The domain is currently offline, preventing immediate interaction, but the presence of the same IP and hosting patterns in historic observations suggests the operator may reuse the infrastructure for future campaigns. Defenders should add the domain and its IP address to local deny lists, monitor for re‑registration of the name, and watch for similar airdrop‑themed pages referencing Solana. Network‑level controls that block traffic to the identified IP range (RU, AS33993) can reduce exposure. Continuous threat‑intel feeds should be consulted for any resurgence of the kit or related indicators.