solxscan[.]xyz

The domain solxscan.xyz was registered on 21 February 2026 through Dynadot LLC and is currently flagged as a high‑risk crypto‑scam phishing site. It is listed as active, with an HTTP 200 response and a page title indicating “solxscan.xyz | 522: Connection timed out”. The classification as a generic phishing operation with a specific crypto‑scam focus derives from the intelligence source that tags the domain accordingly. Infrastructure analysis shows the domain resolves to the IP address 172.67.172.8, which belongs to AS13335, operated by Cloudflare, Inc., located in the United States. The authoritative nameservers are drake.ns.cloudflare.com and yolanda.ns.cloudflare.com, confirming Cloudflare’s DNS service. The TLS certificate is issued by Google Trust Services under the WE1 root, providing a valid HTTPS endpoint. Detected technologies include Cloudflare’s edge network and HTTP/3 support. Reputation data is mixed: VirusTotal records 2 detections out of 95 scanned security vendors, while the Gridinsoft trust score is 0 / 100, indicating a severely malicious rating. The domain appears on two external blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filters. These signals, combined with the explicit crypto‑scam label, suggest a deliberate attempt to lure victims into fraudulent cryptocurrency transactions, despite the relatively low VirusTotal detection count. Defenders should prioritize containment of solxscan.xyz by adding it to network and DNS blocklists, and by monitoring outbound connections to the associated Cloudflare IP range for potential exfiltration attempts. Continuous re‑evaluation is advised, as the site may evolve its content beyond the current “connection timed out” response. Threat‑intel feeds should be updated to reflect the domain’s high‑risk status, and incident response teams should be prepared to investigate any user reports of crypto‑related phishing that reference this domain.