nunusolana[.]com

Analysis of nunusolana.com, created on September 11, 2025 and registered through ERANET INTERNATIONAL LIMITED, shows an infrastructure consistent with a brand‑impersonation crypto scam targeting Solana. The domain resolves to the IPv4 address 147.45.222.156, which is announced by AS216127 belonging to INTERNATIONAL HOSTING COMPANY LIMITED and geolocated in Germany. DNS resolution is provided by the authoritative servers a.dnspod.com and c.dnspod.com. No TLS certificate is presented for the site, indicating that HTTPS is not configured.

The page title returned by the HTTP response is the single word “nunu”, which does not reveal any additional malicious functionality but also provides no legitimate context. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the host. VirusTotal has flagged the domain in three of ninety‑five scanned engines, and the site is listed on two independent blocklists, PhishDestroy and ScamSniffer, both of which categorize it as a crypto‑related scam. The domain is currently marked offline, preventing active probing of its content, and the lack of an SSL certificate further limits analysis of any potential credential‑harvesting pages.

Defenders should treat nunusolana.com as a confirmed malicious indicator. Immediate actions include adding the domain and its resolving IP address to network deny lists, updating intrusion‑prevention signatures, and monitoring for any newly registered domains that reuse the same registrar, nameserver configuration, or hosting provider. Continued observation of the IP range associated with AS216127 is advised, as threat actors often reuse hosting infrastructure for successive campaigns. The limited public evidence—absence of a certificate, low trust score, and presence on reputable blocklists—supports a high‑confidence classification as a Solana brand‑impersonation crypto scam, though further content analysis would be required if the site becomes active again.