solsticevault[.]com

The domain solsticevault.com was observed on July 12, 2026 as an active generic_phishing site delivering a staking scam. The site resolves to the IPv4 address 66.29.141.55 and presents a valid SSL certificate issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA. The page title returned by the HTTP 200 response is identical to the domain name, indicating a simple front‑end designed to mimic legitimate staking platforms.

Infrastructure analysis shows the domain is hosted on Namecheap’s network (AS22612) and uses the authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. The domain was registered on February 21, 2026 through NameCheap, Inc., and its MX configuration includes mx1-hosting.jellyfish.systems (priority 5) and a secondary host (priority 10). The low Gridinsoft trust score of 0 / 100 reflects the malicious nature of the content, while the presence of a valid TLS certificate may be intended to increase user confidence.

Detection metrics reinforce the threat assessment: VirusTotal records 11 out of 95 security vendors flagging the domain, and PhishDestroy has already added it to its blocklist, making the domain appear on one public security blocklist. The high risk rating aligns with the observed staking‑scam behavior, and the active status suggests the infrastructure remains operational and capable of targeting unsuspecting victims.

Defenders should immediately block solsticevault.com at DNS and network layers, enforce email filtering for any messages originating from its MX hosts, and monitor for related IP activity on 66.29.141.55. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this domain, and incident response teams should educate users about the fraudulent staking scheme to reduce successful exploitation.