sray-tkn[.]live

This domain is flagged as a high-risk brand impersonation threat targeting Pump.fun, a decentralized platform for token launches. The site masquerades as a multi-chain portfolio tracker under the title 'SolRay — Multi-Chain Portfolio Tracker,' a tactic designed to exploit user trust in legitimate crypto management tools. Brand impersonation of this nature typically aims to harvest credentials, distribute malware, or facilitate cryptocurrency theft through deceptive interfaces. Analysis indicates the domain sray-tkn.live was registered on May 25, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.97.3 and is currently offline. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and Maltrail. Infrastructure analysis reveals the use of Cloudflare and Cloudflare Browser Insights, alongside HTTP/3, which may obscure origin servers and complicate attribution. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (188.114.97.3) at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to the domain, particularly in environments where cryptocurrency-related activities occur. Users should be educated to verify domain authenticity before interacting with portfolio trackers or decentralized platforms, especially those mimicking Pump.fun. Monitoring for similar registrations through the identified registrar (PDR Ltd.) may help preempt future impersonation attempts.