safemoonpimp[.]fun

This domain, safemoonpimp.fun, was registered on December 27 2025 through Name.com, Inc. and currently resolves to the IPv4 address 34.111.179.208, which is hosted by Google LLC under ASN 396982 in the United States. The domain presents the page title “SAFEMOON” and is classified as a brand‑impersonation campaign targeting the Solana ecosystem. No TLS certificate is associated with the host, indicating that communication is unencrypted. A Gridinsoft trust score of 0 out of 100 has been recorded, reflecting a lack of trust.

The domain appears in a single AlienVault OTX pulse and has been flagged by seven of ninety‑three VirusTotal scanners, demonstrating moderate detection across anti‑malware engines. It is listed on one public security blocklist and has been actively blocked by the PhishDestroy service. Nameserver configuration includes ns1cny.name.com, ns2ckr.name.com, ns3jkl.name.com and ns4hny.name.com. The site is presently taken offline, limiting immediate exposure but preserving the underlying infrastructure for potential reuse.

Evidence confirms impersonation of Solana, yet the exact malicious payload or phishing page content has not been disclosed. Defenders should continue to block the domain at perimeter filters, monitor the associated IP and name server records for reactivation, and update threat‑intel feeds with the observed indicators. Additional analysis of any future re‑hosting attempts is required to determine the full scope of the campaign.