sol-launcher[.]org

Analysis of sol-launcher.org, created on 5 November 2025 and currently taken offline, indicates a deliberate attempt to impersonate the Solana brand for a crypto‑related scam. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv6 address 2a06:98c1:3120::3, which is hosted by Cloudflare (ASN 13335) in the United States. Both authoritative nameservers, garrett.ns.cloudflare.com and grannbo.ns.cloudflare.com, belong to the same provider, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, meaning the site would have been served over plain HTTP, a typical characteristic of low‑cost malicious campaigns. The page title observed during the brief crawl was "Nur einen Moment…", offering no further context about the content.

The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, reinforcing the suspicion of malicious intent. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, indicating a high likelihood of abuse. VirusTotal scanned the domain with 95 detection engines and reported no findings; however, the absence of detections does not equate to safety and may reflect limited coverage of the specific threat vector.

Defenders should treat sol-launcher.org as a high‑confidence indicator of brand impersonation targeting Solana users. Recommendations include adding the domain to network blocklists, monitoring DNS queries for the associated IP range, and ensuring endpoint security solutions are configured to flag any access attempts. Continuous observation of Cloudflare‑hosted infrastructure linked to this domain is advised, as the operator may re‑deploy similar domains using the same hosting provider.