solfun[.]pw

The domain solfun.pw has been identified as engaging in brand impersonation, specifically targeting Solana, a well-known cryptocurrency brand. The site operated under the guise of a 'Solana Claim' page, likely attempting to deceive users into disclosing sensitive information under the pretense of claiming cryptocurrency rewards. The threat is characterized as brand impersonation, suggesting a deliberate attempt to exploit Solana's reputation to gain trust from unsuspecting visitors.

Technical analysis of solfun.pw reveals several critical indicators of its malicious nature. The domain was flagged by 9 out of 95 security vendors on VirusTotal, indicating a significant level of detection among security services. Registered through NameSilo, LLC, the domain resolved to the IP address 172.67.144.249. It was created recently on March 28, 2026, suggesting a new campaign. Google Safe Browsing identified it as engaging in 'SOCIAL_ENGINEERING', further corroborating its malicious intent. The domain appears on one security blocklist, highlighting its recognition by threat intelligence communities.

Currently, solfun.pw is offline and has been blocked by PhishDestroy, reducing its immediate threat level. However, the risk remains that similar domains may emerge, utilizing the same tactics to impersonate cryptocurrency brands. Users are advised to remain vigilant and employ robust security measures, such as two-factor authentication and trusted security software, to mitigate the risk of exposure to similar threats. Continuous monitoring and reporting of suspicious domains are essential to safeguarding against potential future attacks.