solsice[.]finance

This domain, solsice.finance, was observed hosting a page with the title 'Cierpliwości...' and is classified as a crypto‑scam phishing site. The domain resolves to the Cloudflare IP 104.21.89.145, which belongs to AS13335 (Cloudflare, Inc.) and is located in the United States. No TLS certificate is presented, meaning the site was served over plain HTTP, which is a common trait for quick‑turn malicious deployments. The domain is listed on a single security blocklist and received a Gridinsoft trust score of 0 / 100, indicating a complete lack of trust. It is also blocked by the PhishDestroy service.

VirusTotal reports that 15 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent. Nameservers jo.ns.cloudflare.com and renan.ns.cloudflare.com show that the domain is registered through Cloudflare, Inc., a provider often used by threat actors to hide their true hosting location. The current status is offline, which may indicate that the operators have taken the site down after initial distribution or that it is being used intermittently. Because the page content beyond the title has not been captured, the precise lure or victim‑targeting mechanics remain unknown.

Defenders should continue to block the domain at perimeter defenses, update URL filtering lists, and monitor any outbound connections to the associated IP address. Incident response teams encountering traffic to this address should treat it as potentially malicious, collect HTTP request logs, and consider containment actions such as sinkholing the IP or enforcing DNS sinkhole rules. Threat intelligence platforms should ingest the observed indicators – domain name, IP address, nameserver pair, trust scores, and VT detection count – to improve detection coverage. Ongoing reconnaissance on the domain’s historical DNS records and any related sub‑domains is recommended to uncover additional infrastructure that may be re‑used in future campaigns.