meandawg[.]rf[.]gd

This domain is active as of 2026-07-22 and is flagged as a high‑risk brand‑impersonation campaign targeting Solana. The fully qualified domain meandawg.rf.gd returns HTTP 200 responses, indicating a reachable web service. DNS resolution points to 185.27.134.179, an address announced by AS34119 (Wildcard UK Limited) and geolocated to the United Kingdom. The registrar listed is Key Systems GmbH, and the domain was originally registered on 2013‑08‑25, suggesting long‑standing control. Nameservers ns1.infinityfree.com and ns2.infinityfree.com belong to the free hosting provider InfinityFree, a common platform for malicious operators.

The site presents a ZeroSSL ECC Domain Secure Site CA certificate, which provides TLS encryption but does not convey legitimacy. Technical fingerprints reveal the presence of Cloudflare, Unpkg, jQuery and cdnjs libraries, all of which can be leveraged to serve malicious payloads or hide tracking code. Threat‑intel aggregators have recorded 11 of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The domain appears on two public blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer, confirming its detection by dedicated anti‑phishing services. Although the exact page title and content have not been disclosed, the available indicators collectively demonstrate a coordinated effort to impersonate Solana and potentially harvest credentials or funds.

Uncertainty remains around the specific payload delivered and the extent of victim outreach, as no sandbox or payload analysis is provided. Defenders should immediately add meandawg.rf.gd and its resolving IP 185.27.134.179 to network‑level deny lists, monitor DNS queries for the domain and associated InfinityFree nameservers, and enforce web‑filter rules to block TLS connections to the certificate issuer ZeroSSL when paired with this domain.