portal-solstice[.]xyz

Analysis of portal-solstice.xyz reveals a high-risk domain associated with cryptocurrency fraud, currently active as of July 12, 2026. The domain was registered on March 13, 2026, through Dynadot LLC and resolves to IP address 172.67.150.106, part of Cloudflare’s network (AS13335). Infrastructure analysis indicates the use of Cloudflare nameservers (nena.ns.cloudflare.com and sergi.ns.cloudflare.com) and HTTP/3 protocol, alongside a Let’s Encrypt SSL certificate issued under the E8 intermediate. The domain is blocked by three security vendors, including PhishDestroy and MetaMask, and holds a Gridinsoft trust score of 0/100, signaling confirmed malicious activity. The domain’s current HTTP status is 403 Forbidden, though it previously displayed a 504 Gateway Time-out error, suggesting intermittent availability or backend instability. This behavior is consistent with phishing infrastructure designed to evade detection while maintaining operational readiness. While VirusTotal reports only 2 out of 95 security vendors flagging the domain, this low detection rate may reflect limited visibility rather than benign intent, particularly given the domain’s presence on multiple blocklists and its classification as a crypto scam. Defenders should treat portal-solstice.xyz as an active threat, particularly in environments handling cryptocurrency transactions or wallet-related activities. The use of Cloudflare infrastructure complicates attribution and takedown efforts, as the service is frequently leveraged to obscure the true origin of malicious domains. Network-level blocking of the resolved IP (172.67.150.106) and monitoring for related subdomains or SSL certificate patterns (e.g., Let’s Encrypt E8) are recommended mitigation steps. Given the domain’s recent registration and persistent blocklist presence, organizations should prioritize proactive monitoring for similar patterns in newly created domains under the same registrar or hosting provider.