persolex[.]com

Analysis of the domain persolex.com indicates active brand impersonation targeting Solana, a blockchain platform. The domain was registered on September 23, 2025, through CSL Computer Service Langenbach GmbH d/b/a joker.com and currently resolves to the IP address 193.36.85.51, hosted on AS212552 (BitCommand LLC) in Germany. The page title, 'Persolex - Boost PumpFun Tokens,' suggests an attempt to lure users with promises related to token manipulation or fraudulent investment schemes within the Solana ecosystem. The domain is flagged on one security blocklist and was detected by one of 95 security vendors on VirusTotal, though the specific nature of the detection is not detailed. HTTP status code 302 indicates a redirect, which may be used to obscure the final malicious destination or evade detection. Nameservers are hosted under parspack.co (ns1.parspack.co through ns4.parspack.co), a provider frequently observed in malicious infrastructure. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites. Defenders should treat this domain as high-risk due to its association with brand impersonation, active status, and presence on security blocklists. Network-level blocking of 193.36.85.51 and the domain itself is recommended. Further investigation into the redirect chain and any associated wallet addresses or scripts is advised to determine the full scope of the threat. The exact content and functionality of the site remain unanalyzed, and no additional scam categorization beyond brand impersonation can be confirmed at this time.