app[.]soleyer[.]org

This domain is flagged as an elevated-risk credential harvesting platform targeting users of blockchain infrastructure. Analysis indicates the site masquerades as a legitimate hardware-accelerated blockchain service, likely designed to collect sensitive authentication details from unsuspecting victims under false pretenses. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain app.soleyer.org resolves to IP address 172.67.135.184 and was registered through NameCheap, Inc. on February 21, 2026. It appears on two security blocklists and is flagged by 15 out of 95 security vendors in VirusTotal scans. The site employs a Google Trust Services SSL certificate and leverages Cloudflare for content delivery, including HTTP/3 and HSTS protocols. Additional technologies detected include Bootstrap and Ant Design frameworks. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. Mitigation requires immediate action from both end users and network administrators. Users should avoid interacting with the domain or entering credentials on any site presenting itself as app.soleyer.org. Network-level protections should include DNS sinkholing for 172.67.135.184 and implementation of blocklist-based filtering. Organizations operating in the blockchain sector should monitor for credential reuse attempts, particularly from accounts that may have accessed this phishing domain. Given the domain's current offline status, continued vigilance is advised as threat actors may redeploy similar infrastructure under different domains.