solomonlabs[.]app

Analysis as of July 25, 2026 shows that solomonlabs.app is associated with a crypto‑related phishing campaign. The site returned an HTTP 403 response and presented the generic page title “Just a moment…”, which is commonly used by automated takedown pages. VirusTotal recorded four detections out of ninety‑three scanners, confirming that at least a subset of security products consider the domain malicious. The domain resolves to the IPv6 address 2606:4700:3035::ac43:9a6c, which belongs to Cloudflare’s network (AS13335) and is located in the United States. Cloudflare services, including HTTP/3, are observed, and the SSL certificate is issued by Google Trust Services under the WE1 brand, indicating a legitimate certificate chain but not mitigating the phishing intent.

Registration details list NiceNIC International Group Co., Limited as the registrar, and the authoritative nameservers are jo.ns.cloudflare.com and tim.ns.cloudflare.com, both Cloudflare‑managed. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing its classification as a crypto scam. Current status is reported as offline, suggesting the site has been taken down or is temporarily inaccessible, yet the infrastructure remains observable. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the page content was not captured beyond the title.

No additional indicators such as malware hashes, phishing templates, or victim reports are available. Defenders should continue to block the domain at perimeter firewalls and proxy filters, monitor the associated IP range for re‑use, and add the domain to internal threat‑intel feeds. Periodic re‑resolution checks are advised in case the site becomes active again, and any future TLS certificates should be examined for changes. Integrating the blocklist entries into automated URL filtering solutions will help prevent user exposure to this crypto‑focused phishing attempt.