app[.]solv[.]finance[.]neonwallet[.]net

Analysis indicates that the domain app.solv.finance.neonwallet.net was registered on February 21, 2026 through Web Commerce Communications Limited. The authoritative nameservers are kallie.ns.cloudflare.com and kyle.ns.cloudflare.com, pointing to Cloudflare’s network (AS13335, United States). DNS resolution returns the address 188.114.96.3, which is owned by Cloudflare, Inc. The site presented the page title "neonwallet.net | 522: Connection timed out" and employed Cloudflare’s HTTP/3 stack with a Let’s Encrypt E7 certificate. The domain is classified as a crypto drainer, a subset of crypto scams, and appears on one security blocklist. PhishDestroy has actively blocked the host.

VirusTotal analysis recorded detections from 7 of 93 security vendors, confirming a malicious reputation. The domain is currently offline, and no live content could be retrieved for further inspection. The 522 status observed in the page title suggests that the origin server failed to respond within Cloudflare’s timeout window, a behavior often seen when malicious operators deliberately withdraw the site after a campaign. The use of Cloudflare’s edge network obscures the true backend infrastructure, complicating attribution.

No additional intelligence such as Safe Browsing or OTX entries were supplied, so the current evidence set is limited to the registrant, hosting, and vendor detections. Defenders should add the domain and its resolving IP to blocklists, monitor for similar Cloudflare‑hosted subdomains, and enforce TLS inspection where feasible. Security teams should also consider correlating any observed traffic to 188.114.96.3 with other known malicious domains, as Cloudflare IPs are frequently shared among unrelated actors. Continuous re‑evaluation is recommended in case the domain is re‑activated or the infrastructure is replicated elsewhere.