solana-event[.]fun

Analysis of solana-event.fun shows infrastructure consistent with a brand‑impersonation campaign targeting Solana users. The domain was registered on May 25 2025 through Hostinger operations, UAB, and is served from the Cloudflare network (ASN 13335) with the IP address 172.67.217.242 located in the United States. DNS resolves to Cloudflare’s authoritative name servers gene.ns.cloudflare.com and gerardo.ns.cloudflare.com, and no SSL certificate is presented, indicating the site was delivered over plain HTTP. The only visible page element is the title tag "Un momento…", which provides no legitimate context for the Solana brand.

Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious intent. VirusTotal reports that the domain was scanned by 95 security vendors, none of which raised a detection at the time of scanning; this absence of alerts should not be interpreted as a safety indicator. The domain appears on a single external blocklist and has been explicitly blocked by PhishDestroy, reinforcing the suspicion of malicious activity.

The site is currently offline, which limits live verification of payloads or phishing pages, but the observed infrastructure—especially the use of a reputable CDN to obscure origin and the lack of TLS—matches known patterns for crypto‑related scams. Defenders should add solana-event.fun to URL filtering and host‑based allow‑lists as a blocked entry, monitor for any outbound connections to the associated Cloudflare IP, and enforce TLS‑only policies that would prevent users from reaching non‑encrypted endpoints. Further investigation should include querying threat‑intel feeds for related hashes or command‑and‑control indicators, and reviewing any historic traffic logs for attempts to access the domain before it was taken offline.