solstice-finance[.]xyz

This domain, solstice-finance.xyz, is flagged for brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site was designed to harvest wallet credentials and private recovery phrases, likely deploying a cryptocurrency drainer script to automatically siphon funds upon user authentication. The page title 'Solstice' suggests an attempt to masquerade as a legitimate financial platform while exploiting MetaMask’s brand recognition to deceive users. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 25, 2026, an unusually future-dated creation timestamp that may indicate domain spoofing or registry manipulation. It resolves to the IP address 188.114.97.3, which has not yet triggered detections on VirusTotal (0/95 security engines). Despite this, the domain appears on three security blocklists and is actively blocked by MetaMask’s internal filters, PhishDestroy, and SEAL. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. As of the latest verification, solstice-finance.xyz has been taken offline, likely in response to detection and reporting by security entities. However, residual risk persists due to the domain’s registration remaining active, allowing potential reactivation or reuse of its infrastructure. Users who interacted with the site prior to takedown should immediately revoke wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Security teams are advised to maintain blocklist entries for this domain and associated IP address until definitive sinkholing or registrar enforcement actions are confirmed.