starter-luna[.]com

Analysis of starter-luna.com, created on February 21, 2026 and currently offline, reveals multiple indicators of a brand‑impersonation campaign targeting Solana. The domain resolves to IP address 104.21.16.1, which belongs to AS13335 operated by Cloudflare, Inc., confirming the hosting is provided through Cloudflare’s network. The SSL certificate presented is issued by Google Trust Services under the WE1 root, indicating a legitimate‑looking HTTPS configuration, while the HTTP response returns a 403 status, suggesting intentional restriction of direct content access. Nameserver records point to gordon.ns.cloudflare.com and kimora.ns.cloudflare.com, further confirming Cloudflare as the DNS provider.

Reputation data shows a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. VirusTotal analysis flags the domain by five of ninety‑three security vendors, providing modest but notable detection across the threat‑intelligence community. PhishDestroy has actively blocked the domain, reinforcing its classification as a phishing vector. The page title captured from the site – “Luna Launch - Solana Token Launcher” – directly references Solana, aligning with the known impersonation intent.

Registrar information lists CNOBIN INFORMATION TECHNOLOGY LIMITED as the registration entity, a detail that may aid in attribution or takedown efforts. No additional technology fingerprints beyond Cloudflare are observed. Given the combination of a brand‑specific page title, low trust score, partial vendor detections, and active blocklist listings, defenders should continue to monitor the domain, enforce existing blocklists, and consider adding the IP address 104.21.16.1 to network‑level deny lists. Further investigation of any associated traffic patterns or payloads is recommended to assess potential downstream threats.