Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
ネットワークセキュリティインテリジェンス Registrar context
DNS Provider Blocks1 / 13
Quad9 Secure
Registrar contextNiceNIC
Stored registration data identifies NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) as the registrar. PhishDestroy maintains separate NiceNIC abuse-report research; registrar association is contextual and is not an independent detection for this domain.
This domain, solctise.finance, is flagged as part of an airdrop scam infrastructure designed to impersonate legitimate token distribution events. Analysis indicates the site presented itself as a "TRON Airdrop Checker — Claim Your Eligible Tokens" platform, a common tactic to lure cryptocurrency holders into disclosing wallet credentials or transferring funds under false pretenses. No specific drainer kit signatures were identified in available telemetry, though the domain aligns with known patterns of cryptocurrency phishing campaigns targeting decentralized finance (DeFi) users.
Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation timestamp suggesting potential data manipulation or a placeholder record. The domain resolved to IP address 185.218.16.135, hosted on AS400992 (ZhouyiSat Communications) in the United States. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged solctise.finance as malicious, while it appeared on a single security blocklist. The SSL certificate was issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious domains due to its accessibility. Google Safe Browsing data was not explicitly cited, but the domain's inclusion on other blocklists corroborates its classification as high-risk.
As of the latest verification, solctise.finance has been taken offline, likely following detection and reporting by security entities. While the immediate threat is mitigated, the infrastructure may resurface under a different domain or IP address, a frequent tactic in cryptocurrency phishing operations. Users who interacted with the domain should revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of future airdrop claims through official project channels. Organizations should update blocklists to include this domain and its associated IP, while remaining vigilant for similar campaigns leveraging future-dated registration timestamps or Let's Encrypt certificates in combination with cryptocurrency-themed lures.
DOM Analysisanalyzed 2026年7月29日score 93/1001 brand signal
Submitted URLhttps://solctise.finance/
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(RU)
PhishDestroy Investigation
