solaup[.]com

PhishDestroy identifies solaup.com as an active generic phishing domain posing as a solar-energy invoice generator. The site lures victims by masquerading as a legitimate billing tool, harvesting payment details or redirecting to a drainer kit under the guise of issuing invoices for solar panel installations. No specific brand is mimicked; instead, the threat relies on generic “invoice” lures to trick users into entering financial data or transferring funds. The campaign’s infrastructure is minimal and newly stood up, indicating opportunistic targeting rather than a sophisticated supply-chain attack.

This domain was flagged on March 24, 2026 and resolves to IP 188.114.96.3 via Fewmoretaps OU d/b/a Trustname.com. VirusTotal currently returns 4/95 detections, confirming it remains undetected by most scanners. The SSL certificate was issued by Let’s Encrypt, providing a false veneer of legitimacy to phishing pages. As of this report, the domain has not yet been added to Google Safe Browsing (GSB) or major blocklists, leaving a critical gap in automated defenses. The lack of detections and fresh registration suggests the campaign is in its early stages, with potential for rapid expansion.

The campaign is currently active and expanding, with no known takedown or blocklist mitigation at this time. Immediate user action includes blocking 188.114.96.3 at the firewall and disabling access to solaup.com via DNS sinkholing or enterprise blocklists. Users should be warned not to enter any financial or personal data on this domain. Remaining risk is high due to undetected status and low blocklist coverage; the threat may escalate if drainer kits are deployed or if the domain is weaponized against targeted sectors such as renewable energy installers or SMEs.