solana-trading[.]biz

solana-trading.biz is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting the Solana cryptocurrency ecosystem. The domain was registered on August 17 2024 through RegistryGate GmbH and resolves to the IPv4 address 85.13.149.134, which is announced by AS34788 operated by Neue Medien Münnich GmbH in Germany. The authoritative name servers ns5.kasserver.com and ns6.kasserver.com host the zone, and the MX record points to w01999cc.kasserver.com with a priority of 10.

The web service returns HTTP 200 and is powered by Nginx. TLS is provided by a certificate issued by a public certificate authority, indicating that encrypted connections are accepted. Email routing is directed to the same hosting provider, as evidenced by the MX record. No additional infrastructure such as CDN or redirection services is observable from the available data.

VirusTotal analysis shows that 2 of 95 security vendors flagged the domain, and the site is listed on a single security blocklist. It is also blocked by the PhishDestroy filtering system. Independent reputation scoring assigns a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. These signals collectively confirm that the domain is being used for fraudulent activity, specifically cryptocurrency‑related impersonation.

Defenders should deny network traffic to 85.13.149.134 and to solana‑trading.biz at the DNS layer, and add the domain to existing URL filtering and email security policies. Continuous monitoring of the associated IP range and the registrar RegistryGate GmbH is advised, as similar domains may be deployed using the same hosting environment. Incident response teams should treat any communications referencing Solana and originating from this domain as malicious and isolate them for further analysis.