gone[.]wtf

This domain is flagged for elevated-risk brand impersonation targeting Solana, specifically operating as an anonymous cryptocurrency mixer. The infrastructure analysis reveals a direct threat to users seeking privacy-focused transactions, as it likely facilitates unauthorized fund transfers or laundering under the guise of legitimate Solana services. The domain’s intent to deceive is further evidenced by its page title, "Gone.wtf | Anonymous Mixer for Solana," which explicitly misrepresents its association with the Solana ecosystem. Infrastructure analysis indicates the domain resolves to the IP address 216.198.79.1 and was registered through Vercel Inc. It employs a Let’s Encrypt SSL certificate and implements HSTS, suggesting an attempt to appear legitimate. Detection metrics include a Gridinsoft trust score of 0/100, presence on one security blocklist, and flags from 3 out of 95 security vendors on VirusTotal. The domain is currently offline but was previously blocked by PhishDestroy. Technologies detected include Vercel hosting, which aligns with the registration details. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP address (216.198.79.1) across security gateways and endpoint protection systems. Organizations should update phishing detection rules to include the domain’s page title and mixer-related keywords to prevent similar impersonation attempts. Users should be educated on verifying official Solana service URLs and avoiding unauthorized third-party mixers. Monitoring for newly registered domains with similar naming patterns or hosting providers can help preemptively identify related threats. Given the domain’s offline status, continuous scanning for re-emergence is recommended.