memeliquid-com-2d160e[.]pages[.]dev

Analysis indicates that the domain memeliquid-com-2d160e.pages.dev is actively impersonating Solana, a known blockchain platform, as part of a cryptocurrency scam operation. The domain was registered on February 8, 2026, and remains operational as of July 12, 2026, resolving to IP address 172.66.47.166, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The site's page title, 'MemeLiquid | Meme Perps on Solana,' explicitly references Solana, aligning with the reported brand impersonation threat type. Infrastructure analysis reveals the use of Cloudflare nameservers (adi.ns.cloudflare.com, karl.ns.cloudflare.com, keaton.ns.cloudflare.com, magali.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The domain employs HTTP/3 and HSTS, which are common in both legitimate and malicious sites leveraging Cloudflare's security features. The HTTP status code 200 confirms the site is accessible, and its presence on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further supports its classification as malicious. While the domain has been flagged by 3 of 93 security vendors in VirusTotal, this detection rate is not definitive proof of malicious activity but aligns with broader abuse reports. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment. Defenders should treat this domain as an active threat, particularly in environments where Solana-related services are used. No evidence suggests the domain is benign, and its continued operation warrants immediate blocking or monitoring for related indicators of compromise. The exact nature of the scam (e.g., token drainer, fake exchange, or phishing for credentials) is not confirmed in the available data, but the combination of brand impersonation and cryptocurrency targeting is consistent with high-risk fraud schemes.