www-solayer[.]org

This domain, www-solayer.org, was registered on 21 February 2026 through Hostinger operations, UAB. The site presents the page title “Solayer | Hardware‑accelerated SVM” and is classified as a crypto‑scam that impersonates the brand “across”. The domain resolves to the IPv6 address 2a02:4780:44:76a8:19ae:8e39:de7a:d46b, which belongs to AS47583 (Hostinger International Limited) and is geolocated in Germany. SSL analysis shows the certificate labeled “WR1”. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy.

A VirusTotal scan recorded one positive detection out of ninety‑three scanning engines. Gridinsoft assigns a trust score of 10 / 100, indicating a very low confidence level. The current service status is offline, and no additional content has been captured. Analysis indicates that the observable infrastructure aligns with typical malicious‑hosting patterns used for brand‑impersonation and cryptocurrency‑related fraud. The limited blocklist presence suggests the domain has not yet achieved wide propagation, but the presence of a positive detection and a low trust score demonstrate that security vendors have identified malicious behavior.

The lack of further public content, such as login forms or payload samples, leaves the exact phishing or drainer mechanisms unknown. Defenders should continue to block the IPv6 address and the domain at perimeter and DNS filtering layers. Given the SSL certificate and hosting provider, any future re‑hosting on the same AS should be monitored. Adding the domain to internal threat intel feeds and re‑scanning with VirusTotal or similar services when it becomes reachable will help confirm the threat posture. Ongoing observation of the “across” brand impersonation vector is advised, as the domain’s short lifespan (registered less than six months ago) is consistent with fast‑flux phishing campaigns.