solph[.]live

This domain is flagged as an elevated-risk crypto wallet drainer, designed to exfiltrate cryptocurrency credentials through deceptive interfaces. Analysis indicates the infrastructure is tailored to mimic legitimate wallet services, tricking users into authorizing malicious transactions or disclosing private keys. The domain exhibits characteristics consistent with automated phishing kits, including rapid deployment and short-lived operational windows. Infrastructure analysis reveals the domain solph.live was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.164.243 and is currently listed on 3 security blocklists. VirusTotal detection shows 6 out of 95 security vendors flagging the domain as malicious. The Gridinsoft trust score is 0/100, further corroborating its malicious intent. The page title 'Just a moment...' suggests the use of Cloudflare or similar services to obfuscate backend infrastructure. The domain has been blocked by MetaMask, SEAL, and PhishDestroy, indicating prior identification as a threat to cryptocurrency users. Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and registrar details into SIEM and EDR solutions for retrospective hunting. End-users should be educated on recognizing crypto drainer tactics, such as verifying domain authenticity before entering wallet credentials. Multi-factor authentication (MFA) for wallet access and hardware-based key storage are recommended to reduce exposure. Network traffic analysis should prioritize detecting connections to newly registered domains with low trust scores, particularly those resolving to cloud-based hosting providers.