solscltice[.]finance

The domain solscltice.finance is currently offline but exhibits multiple indicators that align with malicious infrastructure used for phishing or crypto‑related scams. Registration data shows the domain was provisioned through Cloudflare, Inc., and its authoritative nameservers are kara.ns.cloudflare.com and vasilii.ns.cloudflare.com, both standard Cloudflare endpoints. DNS resolution points to IP address 104.21.65.210, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the host, meaning the site is reachable only via plain HTTP.

The HTTP response presents the page title “This Page Is For Sale,” a generic placeholder that offers no functional content but is commonly observed on domains that have been seized or are awaiting further exploitation. Threat intelligence aggregators have flagged the domain: VirusTotal reports that 16 of 95 security vendors label the host as malicious, and the Gridinsoft trust score is 0 / 100, indicating a lack of trustworthiness. The domain is listed on at least one security blocklist and has been explicitly blocked by the PhishDestroy service. Although the exact phishing payload or lure has not been captured, the combination of a Cloudflare‑hosted IP, absence of SSL, low trust score, and multiple vendor detections strongly suggests the domain was intended for a crypto‑focused phishing campaign.

Uncertainty remains regarding the specific content that was served before takedown, as the only observable page title is a sale notice and no malicious landing page was archived. Defenders should continue to block solscltice.finance at the network perimeter, add it to URL filtering lists, and monitor for any re‑registration or new activity associated with the same IP range. Given the elevated risk rating, any future resolution to a live host should trigger immediate investigation and containment.