solana-sniper[.]app

solana-sniper.app is flagged as a brand‑impersonation site targeting Solana users. The page title observed during the scan reads “PumpFun Sniper Bot | Advanced Solana Trading Bot”, indicating an attempt to lure cryptocurrency traders with a purported Solana‑based bot service. The domain resolves to 104.21.64.251, a Cloudflare address (ASN 13335) located in the United States. HTTP requests return a 301 redirect, and the TLS handshake presents a certificate issued by Google Trust Services under the WE1 trust anchor, confirming the use of a valid public certificate.

Infrastructure analysis shows the domain is delegated to the Cloudflare name servers cash.ns.cloudflare.com and mckinley.ns.cloudflare.com. Registration was performed through Porkbun LLC, a registrar known for low‑friction domain onboarding. The site is presently listed on a single security blocklist and has been actively blocked by the PhishDestroy service. No detections were reported on VirusTotal (0/95 scanners), but the lack of signatures does not imply benign intent.

The risk level is recorded as under_investigation, and the operational status remains active. Publicly available intelligence does not include a detailed content snapshot beyond the page title, leaving the exact phishing mechanics, credential collection forms, or malicious payload delivery unknown. Analysts should treat the domain as hostile until a full content inspection confirms otherwise.

Defenders are advised to add solana‑sniper.app to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare IP range, and enforce email filtering rules that flag unsolicited messages referencing “PumpFun” or “Sniper Bot” tied to Solana. Continuous re‑evaluation is recommended as additional telemetry becomes available, particularly any changes in HTTP response codes, certificate updates, or detection on additional threat‑intel platforms.