solanavolumebot[.]app

The domain www.solanavolumebot.app was registered on 2025-11-05 through Name.com, Inc. The site presents the page title “Solana Volume Bot – Boost Your Token Trading Volume & Liquidity” and claims to offer a volume‑boosting service for Solana tokens, directly targeting the Solana brand. Analysis shows the domain resolves to IP 216.198.79.65, an Amazon‑owned address (AS16509) located in the United States. The hosting infrastructure uses Cloudflare as a reverse‑proxy and advertises HTTP/3 support, while front‑end assets reference Tailwind CSS and the jsDelivr CDN. DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating Vercel‑based name server configuration. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming that the site employs a valid HTTPS certificate but does not guarantee legitimacy.

HTTP requests receive a 301 permanent redirect status, a common technique to preserve SEO or to mask malicious endpoints. VirusTotal reports a single detection out of 95 scanned vendors, suggesting at least one AV engine has identified the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on the PhishDestroy blocklist, reinforcing its classification as a high‑risk crypto scam. The threat is typed as “brand impersonation” because the content explicitly references Solana and attempts to lure users into a purported token‑trading service.

The available intelligence does not disclose the exact payload or credential‑harvesting mechanisms; the site’s content has not been fully dissected for malicious scripts or redirects beyond the observed 301 response. Consequently, defenders cannot confirm whether the page exfiltrates data or installs additional binaries. Nonetheless, the combination of a low trust score, a vendor detection, presence on a phishing blocklist, and the brand‑targeted page title warrants immediate mitigation. Recommended actions: block or sinkhole www.