hbwwgs[.]org

The domain hbwwgs.org has been identified in an elevated risk campaign targeting the Solana cryptocurrency brand through brand impersonation techniques. Analysis confirms the domain used a landing page with the title 'Welcome' and integrated several common web technologies, indicating an attempt to present a legitimate appearance. There is no direct evidence of a crypto drainer kit in use, but impersonation targeting a major cryptocurrency platform reflects a high potential for user deception and financial loss.

Technical intelligence substantiates the threat. The domain was registered via Dynadot LLC on March 6, 2025, and resolved to the IP address 23.225.199.94. VirusTotal analytics show 14 out of 95 vendors flagging this domain with malicious indicators, highlighting a clear danger. Gridinsoft assigned a trust score of 0/100. The domain appears on at least one security blocklist and is blocked by PhishDestroy. Detection of web technologies including Bootstrap, jQuery, Lodash, and Caddy, suggests the infrastructure was purpose-built, possibly to mimic authentic Solana interfaces. HSTS implementation points to an effort to foster trust with secure web communication.

At the time of reporting, hbwwgs.org is offline, which effectively reduces immediate risk. However, the domain's prior detection across multiple security platforms and verified blocklist presence necessitates ongoing vigilance. Users are advised to verify domain authenticity before engaging with any cryptocurrency platforms, regularly consult updated blocklists, and report suspicious activity. Organizations should monitor for potential re-registration or cloning of this attack infrastructure on new domains. Immediate action to educate end-users on identifying brand impersonation attempts remains recommended.