paperhands[.]live

Analysis indicates that paperhands.live is an active brand impersonation domain targeting Solana, a well-known cryptocurrency platform. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to IP address 192.64.118.37, hosted on AS22612 (Namecheap, Inc.) in the United States. The page title, 'Solana Paperhands Checker,' suggests the site is designed to deceive users by leveraging Solana’s branding, likely to exploit individuals involved in cryptocurrency trading or investment. Infrastructure analysis reveals the domain uses Namecheap hosting nameservers (dns1.namecheaphosting.com and dns2.namecheaphosting.com) and presents a valid SSL certificate issued by Sectigo Limited, which may lend a false sense of legitimacy. The site returns an HTTP 200 status, confirming it is operational as of July 12, 2026. Security vendors have flagged the domain, with 12 out of 95 engines on VirusTotal detecting it as malicious. It is currently blocked by at least two security blocklists, including PhishDestroy and ScamSniffer, and holds a Gridinsoft trust score of 0/100, indicating high risk. The scam type is classified as a crypto scam, though the exact mechanics—such as whether it functions as a wallet drainer, fake giveaway, or credential harvester—remain unconfirmed due to limited public analysis of the site’s content. Defenders should treat this domain as a confirmed threat and implement blocking measures at the DNS or network level. Organizations handling Solana-related assets or user data are advised to monitor for interactions with this domain and educate users about the risks of engaging with unverified crypto tools or checkers.