solv[.]solvbtc[.]sbs

This domain, solv.solvbtc.sbs, is actively flagged as a high-risk phishing resource targeting users of the SolvBTC platform. Registered on April 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 188.114.96.3, hosted under CloudFlare infrastructure in Canada. Analysis indicates the use of CloudFlare nameservers (nash.ns.cloudflare.com and romina.ns.cloudflare.com), a common tactic to obscure hosting origins and evade immediate takedowns. The domain appears on at least one security blocklist, and nine out of ninety-five security vendors on VirusTotal have detected malicious activity associated with it, reinforcing its classification as a threat. The domain returns an HTTP 200 status code, yet presents a '403 Forbidden' page title, suggesting either a misconfigured or intentionally restricted phishing landing page. This behavior is consistent with credential harvesting campaigns that limit access to specific user agents, geolocations, or referral sources to avoid detection. The SSL certificate, issued by Let's Encrypt with serial number E7, provides encrypted communication but does not validate the legitimacy of the domain. The Gridinsoft trust score of 0/100 further corroborates the domain's association with malicious activity. While the exact phishing kit or payload remains unconfirmed, the domain's naming convention—mimicking SolvBTC—strongly indicates an intent to deceive users into submitting sensitive credentials or financial details. The registration age of approximately three months suggests the campaign may still be in an active or scaling phase. Defenders should treat this domain as hostile and prioritize blocking both the domain and its resolving IP address at the network level. Monitoring for related subdomains or newly registered lookalike domains under the same registrar is recommended to preempt further abuse.