mat[.]onsol[.]sbs

Analysis of mat.onsol.sbs indicates a malicious infrastructure used for wallet or seed phishing. The domain, registered through Web Commerce Communications Limited, was created on 21 November 2025 and resolves to the IPv4 address 91.92.242.155, which is owned by AS202412 Omegatech LTD in the Netherlands. No TLS certificate is present, meaning the site is only reachable over HTTP. The page title returned from the host is “Digital Sovereignty Foundation Claim”, which does not directly reference the targeted brand but the intelligence set classifies the campaign as “brand impersonation” with the generic target label “across”.

VirusTotal scans show that nine of ninety‑five security vendors have flagged the domain as malicious, and the site appears on a single external blocklist and is currently listed by PhishDestroy as taken offline. A Gridinsoft trust score of zero out of one hundred further corroborates the malicious rating. Nameservers are ariella.ns.cloudflare.com and curt.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The combination of a recent registration date, lack of SSL, low trust score, and multiple vendor detections suggests an active phishing operation that likely attempts to harvest cryptocurrency wallet seeds from unsuspecting victims.

However, the exact content of the landing page has not been captured, and the specific brand being impersonated remains ambiguous beyond the generic “across” label. Defenders should block the domain at perimeter firewalls, add the IP address 91.92.242.155 to deny lists, and monitor for DNS queries to the associated Cloudflare nameservers. Continuous re‑scanning on VirusTotal and inclusion in internal phishing‑email detection rules are recommended, as well as user awareness training about unsolicited requests for wallet seeds. The offline status may be temporary; threat hunters should retain the indicator set for future correlation.