solmy[.]cfd

The domain solmy.cfd was registered on February 21, 2026 through Global Domain Group LLC and is presently taken offline. Technical checks show the zone is delegated to Cloudflare’s authoritative name servers memphis.ns.cloudflare.com and sierra.ns.cloudflare.com, resolving to the IPv4 address 172.67.221.58, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented for the host, indicating that HTTPS was never configured before the takedown. VirusTotal has recorded 14 detections out of 93 scanned scanners, and the domain appears on a single external blocklist.

PhishDestroy has already added the host to its block list, reinforcing the assessment. The page title retrieved before shutdown reads "Phantom: The crypto Airdrop for everyone," explicitly referencing the Phantom brand and matching the listed brand target. The observed kit is identified as an "Airdrop Scam," classifying the activity as a crypto‑focused impersonation campaign. While the site is no longer reachable, the infrastructure footprint remains useful for threat hunting: the Cloudflare IP range is shared by many legitimate services, so defenders should not block the entire ASN but should flag any future DNS records that map to the same IP address or its immediate neighbors for the same brand keywords.

Continuous monitoring of the registrar Global Domain Group LLC for new registrations that mimic Phantom or other crypto projects is advised. Adding solmy.cfd to internal deny lists, updating URL filtering rules, and correlating any user‑reported phishing attempts with the observed page title will help reduce exposure. The limited number of blocklist entries and the modest VirusTotal detection count suggest the campaign was relatively small, yet the brand impersonation heightens risk for users seeking legitimate airdrops.