solusdc[.]live

The domain solusdc.live has been identified as a credential theft operation, currently offline but previously active. This domain did not impersonate a specific brand but employed generic phishing techniques to harvest user credentials, likely through deceptive login portals or fraudulent authentication prompts. Analysis indicates the domain was designed to exploit trust in Cloudflare-hosted services, a tactic increasingly observed in credential theft campaigns. Infrastructure analysis reveals solusdc.live was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.168.251, a Cloudflare-hosted endpoint. It appeared on one security blocklist, suggesting limited but confirmed malicious activity. The SSL certificate was issued by Google Trust Services, a common feature in both legitimate and malicious domains to avoid immediate browser warnings. Technologies detected include HTTP/3, HSTS, and Cloudflare Browser Insights, which may have been leveraged to evade detection or enhance perceived legitimacy. The domain is currently offline, but its infrastructure remains a potential risk. Organizations and users are advised to block the domain and its associated IP (172.67.168.251) at the network level. Security teams should monitor for related domains registered through the same registrar (NiceNIC International Group Co., Limited) or resolving to Cloudflare IPs, as these may indicate follow-up campaigns. Users who interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Network logs should be reviewed for connections to the domain or IP to assess potential compromise.