solaxy-mainnet[.]com

Analysis of solaxy-mainnet.com, registered on 21 February 2026, shows a short‑lived domain used to host a page titled “SOLX Staking UI”. The domain resolved to 104.21.29.98, an address owned by Cloudflare (AS13335) located in the United States. The TLS certificate presented as “WE1”, which is not associated with a widely trusted certificate authority and aligns with the low‑trust certificates often deployed by malicious operators. The page title suggests an attempt to lure users into a cryptocurrency staking interface, consistent with the classified “Crypto Scam” label.

Threat intelligence aggregators have added the domain to two security blocklists, specifically PhishDestroy and ScamSniffer, confirming its malicious reputation. VirusTotal scanned the domain and recorded a single positive detection out of 93 scanning engines, indicating at least one vendor identified malicious behavior. No additional public analysis such as Safe Browsing, OTX, or registrar reputation is available in the current data set.

The domain is presently offline, which may indicate a takedown or temporary suspension, but the underlying infrastructure—use of a Cloudflare edge node and a non‑standard certificate—remains reusable for future campaigns. Defenders should continue to block the domain and its resolving IP address at the network perimeter, monitor for re‑registration of similar‑sounding names, and incorporate the observed indicators (creation date, SSL fingerprint, page title, blocklist entries) into threat‑intel feeds. Ongoing observation of IP 104.21.29.98 for new malicious domains is advised, as Cloudflare hosts many unrelated sites and malicious actors can quickly spin up new domains on the same edge node.