solmememint[.]com

The domain solmememint.com was registered on 12 October 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.206.234 located in the United States. The authoritative nameservers are brett.ns.cloudflare.com and ryleigh.ns.cloudflare.com. No TLS certificate is presented, indicating that the site was served over plain HTTP when it was reachable. The only visible page title retrieved before the site was taken offline reads “Luna Launch – Solana Token Launcher,” which does not reference the targeted brand but aligns with the reported wallet/seed phishing kit.

The threat actor explicitly claims to impersonate Discord, as indicated in the intelligence feed, and the scam type is identified as wallet/seed phishing, suggesting attempts to harvest private keys or recovery phrases from Discord users. Reputation checks show a low trust rating: Gridinsoft assigns a score of 0 / 100, and three of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming that external defenses have recognized it as abusive. The lack of an SSL certificate, combined with the low trust score and vendor detections, reinforces the malicious intent.

Because the site is currently offline, dynamic analysis of the landing page content is not possible, and the exact phishing workflow remains unknown. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds, and monitor the associated Cloudflare IP for any future reuse. Incident response teams encountering URLs pointing to solmememint.com should treat them as credential‑stealing attempts targeting Discord accounts and advise users to avoid sharing wallet seeds or Discord authentication tokens. Ongoing observation of the registrar NiceNIC and the Cloudflare IP range may reveal additional campaigns that reuse the same infrastructure.