solaeyer[.]foundation

Analysis of the domain solaeyer.foundation, created on February 07, 2025 and registered through Web Commerce Communications Limited, shows multiple indicators of malicious activity. The site was hosted on Cloudflare infrastructure (IP 104.21.80.1, AS13335) and used the Cloudflare nameservers clayton.ns.cloudflare.com and gemma.ns.cloudflare.com. No TLS certificate was present, and an HTTP request returned the page title "Sorry, the website has been stopped," confirming that the service has been taken offline. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on four security blocklists.

Independent blocklist providers PhishDestroy, Polkadot, Enkrypt, and Codeesura have all listed the domain as hostile. VirusTotal scans recorded seven detections out of ninety‑five vendor submissions, reinforcing the suspicion of abuse. AlienVault OTX references the domain in a single threat‑intelligence pulse, and the listed scam type is an NFT scam, indicating that the site was likely used to lure victims into fraudulent non‑fungible token transactions.

While the exact payload or phishing page content is not available, the convergence of a zero trust score, multiple blocklist listings, a non‑zero VirusTotal detection count, and the explicit NFT scam designation provide a strong confidence level that the domain was employed for phishing or fraud. Defenders should continue to block the domain at network and endpoint layers, monitor for any residual DNS queries, and consider adding the domain to internal allow‑list exclusions to prevent accidental access. Ongoing observation of the associated IP range is advised, as Cloudflare hosts many unrelated sites, but the specific host identifier (104.21.80.1) should remain on watchlists pending any re‑activation.