sharkvssoluna[.]lynx-buyback[.]xyz

The domain sharkvssoluna.lynx-buyback.xyz is currently flagged as a crypto‑related phishing site. Registration data shows the domain was created on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, and its authoritative nameservers are romina.ns.cloudflare.com and skip.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to the IPv4 address 185.95.159.71, which belongs to AS209101 (Vendetta Inc.) and is geolocated in the United Kingdom. No TLS certificate is presented for the host, confirming the absence of HTTPS protection. VirusTotal scans have recorded three positive detections out of ninety‑five submitted security engines, and the domain is listed on a single external blocklist.

PhishDestroy has taken the site offline, and the current HTTP status is reported as offline, preventing direct content retrieval. The page title returned from the last known capture reads “soluna vs SHARK - LynxHL Voting”, which aligns with the reported scam type of a crypto scam. No Safe Browsing, Open Threat Exchange, or additional vendor reputation scores are available in the public record. Analysis indicates that the infrastructure—Cloudflare‑managed DNS, a UK‑based IP address, and a lack of TLS—matches patterns observed in other cryptocurrency phishing campaigns that rely on rapid domain turnover and simple hosting. The limited detection footprint (three vendors) suggests the site may have evaded broader detection, but the presence on PhishDestroy and a blocklist confirms malicious intent.

Defenders should immediately block sharkvssoluna.lynx-buyback.xyz at the network perimeter and add the associated IP 185.95.159.71 to deny lists. Monitoring of other domains hosted on the same IP range or under the same registrar is advised, as threat actors frequently reuse registration services. Email security gateways should be tuned to flag messages referencing “soluna”, “SHARK”, or “LynxHL” to reduce user exposure.