solana-analyse[.]0dev[.]fun

On July 24, 2026 analysts observed that the domain solana-analyse.0dev.fun is currently offline but was previously associated with a crypto‑related impersonation of the Solana brand. The site’s page title was recorded as “solana-address-oracle”, indicating an attempt to present itself as an address lookup service for Solana. VirusTotal reported a single positive detection out of 95 scanned security vendors, confirming that at least one vendor flagged the domain as malicious. The domain resolves to the IP address 64.29.17.65, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to the United States.

The hosting provider is therefore Amazon Web Services, a common infrastructure for abuse. The registrar listed for the domain is HOSTINGER operations, UAB, and the domain was created on July 09, 2025. No SSL certificate was found for the host, and the nameservers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or parking‑service domains. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one security blocklist, where it was also blocked by PhishDestroy.

The evidence collectively points to a brand‑impersonation campaign targeting Solana users, likely aiming to harvest wallet addresses or lure victims into cryptocurrency transactions. Because the site is offline, active mitigation is limited, but defenders should continue to block the domain at perimeter defenses, update URL filtering lists, and monitor the associated IP address for any re‑use. Additional investigation should focus on whether the IP has hosted other malicious domains and whether the registrar’s abuse contacts have been notified. Until further activity is observed, the domain should be treated as high‑risk for crypto‑related social engineering.