licensesresolver[.]org

The domain licensesresolver.org was registered on December 18, 2025 through Global Domain Group LLC and is presently taken offline. Infrastructure analysis shows the domain resolved to the IP address 185.100.85.247, which belongs to AS200651 FlokiNET ehf located in Romania. The host uses the nameservers ns1.host-forest.com and ns2.host-forest.com, and it presents no TLS certificate, indicating that any HTTP connection would be unencrypted. The site’s page title was recorded as "Blockchain Rectification Solution," and the operation is classified as a wallet/seed phishing campaign that employs the Wallet Connect Abuse kit to impersonate the Ethereum brand.

Threat intelligence feeds have flagged the domain on five security blocklists, and it has been explicitly blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The Gridinsoft trust score for the domain is 0 out of 100, reinforcing its malicious reputation. VirusTotal scans show that six out of ninety-three security vendors flagged the domain as malicious.

Although the site is currently offline, the combination of a brand impersonation claim, a known phishing kit, low trust score, multiple blocklist listings, and vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain and its associated IP address, monitor for any re‑hosting attempts, and consider adding the domain to internal allow‑list exclusions. Observers should also watch for similar domains using the same nameserver pair or AS and for any new registrations that mimic the "Blockchain Rectification Solution" title to pre‑empt future campaigns.