solsagebot[.]pages[.]dev

This domain, solsagebot.pages.dev, was identified as a brand impersonation scam targeting Pump.fun, a known platform. The domain was registered on March 23, 2026, and is currently offline, returning an HTTP 403 status. Analysis indicates it was flagged by 9 of 94 security vendors on VirusTotal, though this detection count reflects only a subset of available engines and does not confirm absolute maliciousness. The domain resolves to IP 172.66.47.36, hosted under Cloudflare, Inc. (AS13335) in Canada, and employs Cloudflare nameservers (aragorn.ns.cloudflare.com, becky.ns.cloudflare.com). SSL certification is provided by Google Trust Services (WE1), and the site enforces HSTS and HTTP/3 protocols, which are common among both legitimate and malicious infrastructure leveraging Cloudflare services.

The page title, 'SolSage Bot - All-In-One Pump.fun Software,' explicitly indicates an attempt to impersonate Pump.fun, likely to deceive users into interacting with fraudulent software. The domain appears on at least one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. No evidence of a specific phishing kit or additional payload delivery was present in the available data, and the exact content of the site remains unanalyzed due to its current offline status. Defenders should treat this domain as confirmed malicious based on its brand impersonation, detection by multiple security vendors, and inclusion on blocklists.

The use of Cloudflare hosting and SSL does not mitigate the risk, as these services are frequently abused by threat actors. Network-level blocking of the domain and its resolving IP (172.66.47.36) is recommended. If historical DNS or proxy logs indicate prior access from internal systems, review for potential credential exposure or unauthorized software downloads. Monitor for re-registration or rebranding of the domain, as threat actors often reuse infrastructure.