copyconnection[.]top

This investigation documents the infrastructure and threat indicators associated with copyconnection.top, a domain currently listed as offline but previously identified as a crypto‑drainer targeting Solana users. The domain was registered on 21 February 2026 through the registrar 耐思尼克国际集团有限公司 and resolved to the IPv4 address 109.61.108.113, which is assigned to AS33842 (Citytelecom LLC) in Russia. The hosting environment presents a front‑end stack composed of Node.js, React, Next.js, Webpack and an Nginx web server, all delivered under a Let’s Encrypt certificate (issuer E8). DNS is served by four CloudNS nameservers (ns71.cloudns.net., ns72.cloudns.com., ns73.cloudns.net., ns74.cloudns.uk). A HTTP request to the site returns status 403, indicating restricted access before the takedown.

Reputation systems uniformly flag the site as malicious. Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX includes the domain in one threat‑intelligence pulse, and four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura) have already added it. VirusTotal records 14 detections out of 93 scanning engines, confirming a consensus of malicious behavior. The page title captured before removal reads “Web3 Portal for Everyone | Airdrops, Bitcoin, Solana, Mantle, Crypto and More,” and the site advertises a fake airdrop campaign, directly impersonating the Solana brand.

The underlying malicious payload aligns with the “Wallet Connect Abuse” drainer kit, a known method for harvesting private keys via abused wallet‑connect sessions. Although the site is currently unreachable, the retained evidence suggests a coordinated attempt to lure Solana holders into granting wallet access, thereby enabling unauthorized transfers of assets.