solanabotpump[.]fun

Analysis of solanabotpump.fun shows that the domain was registered through NameSilo on 7 April 2025 and is currently hosted behind Cloudflare (AS13335) with the IP address 188.114.97.3, which geolocates to the United States. The authoritative name servers are anton.ns.cloudflare.com and zita.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. No TLS certificate was observed, confirming that the site was served over HTTP only. The page title returned by the HTTP response reads "Pump Fun Sniper Bot | Solana MEV BOT", directly referencing Solana and suggesting a wallet or seed phishing campaign aimed at Solana users. Gridinsoft assigned a trust score of 0 out of 100, and the domain has been added to at least one public security blocklist.

PhishDestroy has also listed the domain as blocked. VirusTotal reports that one out of ninety‑five scanned scanners flagged the domain, reinforcing the suspicion of malicious activity. The domain is presently taken offline, so live content cannot be examined, and the lack of HTTPS limits further technical fingerprinting. Apart from the single blocklist entry and the minimal VirusTotal detection, no additional public reputation feeds, such as OTX or Safe Browsing, are referenced in the available data. Consequently, the full extent of the phishing infrastructure, including any associated command‑and‑control servers or malicious payloads, remains unknown.

Defenders should continue to monitor the IP address 188.114.97.3 for any resurgence of activity and ensure that network perimeter controls block connections to this host. Email and web filtering solutions ought to be updated with the domain name and its known sub‑domains to prevent accidental user exposure. Incident response teams should be advised to treat any Solana‑related credential or seed phrase submissions originating from this domain as compromised and to instruct affected users to rotate their wallets immediately.