sol-foundry[.]fun

Analysis of sol-foundry.fun confirms its classification as an active crypto scam infrastructure impersonating the Solana blockchain platform. The domain, registered on October 21, 2025, through OVH, SAS, resolves to IP address 198.18.1.143, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (karina.ns.cloudflare.com and kyrie.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), with HTTP/3 protocol detected. The site returns an HTTP 520 status code, a common Cloudflare error indicating potential server-side issues or misconfiguration, which may be leveraged to obscure malicious activity. The page title 'Sol Foundry' and the domain's branding explicitly target Solana, a known cryptocurrency platform, aligning with the scam type labeled as 'Crypto Scam.' At the time of this report, the domain appears on one security blocklist and is flagged by 8 of 95 security vendors in VirusTotal, indicating moderate detection coverage. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activity occurs. Monitoring for related infrastructure, such as newly registered domains under the same registrar or resolving to the same IP, is recommended to identify potential campaign expansion. The use of Cloudflare may complicate attribution and takedown efforts, as the service is frequently abused to mask hosting origins. Further analysis of the site's content and backend functionality is required to determine the exact mechanics of the scam, though the available data confirms its malicious intent.