resolvlabs[.]xyz

Analysis of resolvlabs.xyz indicates a high‑risk, active phishing infrastructure targeting cryptocurrency users. The domain was registered on March 11 2026 through Unstoppable Domains, Inc., and resolves to 104.21.51.212, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution is served by sloan.ns.cloudflare.com and zeus.ns.cloudflare.com, and the site presents a Let’s Encrypt/E7 certificate, confirming that TLS is correctly configured despite the malicious intent. HTTP requests return a 403 status code and the page title is limited to "Just a moment...", suggesting that the front‑end content has not been publicly disclosed. The domain is currently listed on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX references the domain in a single threat‑intel pulse. VirusTotal reports that 2 of 94 scanners have flagged the domain, reinforcing the suspicion of malicious activity. While the exact phishing payload and victim interaction flow remain unverified, the combination of recent registration, low trust score, blocklist presence, and detection by multiple security vendors confirms a credible crypto‑phishing threat. Defenders should immediately block resolvlabs.xyz at the network perimeter, add the domain to local and cloud‑based blocklists, and monitor for any DNS or certificate changes that could indicate repurposing. Continuous observation of related IP 104.21.51.212 and its Cloudflare‑hosted services is advised to detect potential expansion of the campaign.