solstice-reallocation[.]app

Analysis of solstice-reallocation.app indicates that the domain was registered on May 12, 2026 through PDR Ltd. operating under the PublicDomainRegistry.com name. The authoritative nameservers are collins.ns.cloudflare.com and lee.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, and the domain resolves to the IPv4 address 172.67.192.245, which is part of Cloudflare’s edge network. The domain appears on three public security blocklists and is actively listed by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intelligence feeds have observed malicious activity associated with the host.

VirusTotal scans have resulted in five detections out of ninety‑one antivirus engines, providing additional independent confirmation of a phishing payload. The threat is classified as generic phishing with an elevated risk rating, and the current status is active as of the report date, July 29, 2026. No publicly available information on SSL certificate details, HTTP response codes, or page content has been disclosed, so the visual or functional characteristics of the site remain unknown.

Defenders should block the domain at DNS and proxy layers, add the IP address 172.67.192.245 to deny lists, and ensure that any traffic to the associated Cloudflare edge node is inspected for credential‑harvesting patterns. Continuous monitoring of the three blocklists and the listed security vendors is recommended to capture any changes in detection count or additional indicator updates. Organizations using email filtering should treat messages containing this domain as malicious, and users should be warned against clicking links that resolve to the domain.