punch-migrate[.]live

The domain punch-migrate.live was observed on 2026-07-12 exhibiting high-risk brand-impersonation activity targeting the Solana ecosystem. The site presents a page titled “Punch on Sol | $PUNCH - The Coziest Monkey on Solana 🐵”, a clear attempt to masquerade as an official Solana project and lure users into credential or token theft. Technical profiling shows the domain resolves to IP 104.21.82.138, hosted behind Cloudflare, Inc. in Canada. The authoritative nameservers are jill.ns.cloudflare.com and noel.ns.cloudflare.com, and the site serves a valid Let’s Encrypt certificate (E7). HTTP requests return status 200, indicating the front-end is actively delivering content. Open-source intelligence flags the domain as blocked by multiple defensive feeds, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in a single threat pulse, and it appears on three external blocklists. The Gridinsoft trust score of 0/100 reflects an extremely malicious rating, while VirusTotal currently reports 0 detections out of 95 engines, suggesting the payload has not yet been identified by scanners. Analysts should treat punch-migrate.live as an active malicious infrastructure. Immediate mitigation steps include adding the domain and its resolving IP to network deny lists, monitoring DNS queries for the associated Cloudflare nameservers, and deploying URL filtering rules that capture the exact page title pattern. Continuous re-evaluation is advised, as the site may evolve to host additional phishing pages or malicious binaries.