solanavolumebot[.]life

Analysis of www.solanavolumebot.life performed on July 24, 2026 identifies the domain as an elevated‑risk crypto impersonation campaign targeting the Solana brand. The site was registered through Name.com, Inc on October 10, 2025 and is currently taken offline. DNS resolution points to a single IPv4 address, 64.29.17.65, which belongs to AS16509 operated by Amazon.com, Inc and is geolocated in the United States. The domain uses Vercel‑provided nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the underlying hosting stack displays Vercel technology and enforces HTTP Strict Transport Security.

The TLS certificate is issued by Let’s Encrypt (R12), indicating a valid HTTPS endpoint at the time of capture. HTTP responses return status code 451, and the page title exposed during the brief live period reads “Advanced Solana Volume Bot | Automated DEX Trading Volume Generator 2025,” confirming the intent to market a volume‑inflation service for Solana decentralized exchanges. Threat intelligence shows the domain appears on one security blocklist and has been flagged by a single vendor out of 95 submissions on VirusTotal, suggesting limited but non‑trivial detection. PhishDestroy has also listed the domain as blocked.

The evidence set does not include any additional content analysis, malware payloads, or user‑interaction data, leaving the exact malicious payload unknown. Defenders should immediately block the domain and its resolved IP address at perimeter and DNS layers, add the host to internal blocklists, and monitor for other Vercel‑hosted domains that resolve to the same address range. Continuous observation of new registrations using the same registrar, similar naming patterns, or the “solanavolumebot” keyword is advised to catch potential re‑use.