solpump[.]win

Analysis of the domain solpump.win indicates active phishing infrastructure targeting cryptocurrency users. Registered on May 22, 2026, through Global Domain Group LLC, the domain currently resolves to IP address 91.92.243.12, hosted by a provider in the United States. The site returns an HTTP 200 status with a page title of 'Loading,' a common tactic to delay detection while preparing malicious content. SSL certification is provided by Let's Encrypt, a legitimate but frequently abused service for phishing domains. Security vendors have begun flagging this domain, with one out of ninety-five engines on VirusTotal identifying it as malicious. The domain appears on three distinct security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL, suggesting a focus on credential harvesting or wallet-draining attacks. The Gridinsoft trust score of 0 out of 100 further supports the assessment of high risk. No specific brand impersonation has been confirmed, though the presence on MetaMask's blocklist implies potential targeting of decentralized finance users. Defenders should treat this domain as actively hostile. The combination of a recent registration date, minimal detection coverage, and a generic yet suspicious page title suggests an operation still in its early stages or designed to evade automated analysis. Network-level blocking of 91.92.243.12 and the domain itself is recommended, alongside monitoring for related infrastructure using the same IP or registrar. Given the domain's inclusion on multiple cryptocurrency-focused blocklists, security teams should prioritize reviewing logs for connections from internal systems, particularly those interacting with wallet services or decentralized applications.