bot[.]solcoin[.]xyz

Analysis of bot.solcoin.xyz indicates an active brand-impersonation campaign targeting GoDaddy. The domain was registered on June 19, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina and resolves to the IPv6 address 2a02:26f0:4700:1a6::1771, which is assigned to AS20940 Akamai International B.V. in the Czech Republic. Authoritative nameservers are ns1.afternic.com, ns2.afternic.com, and verification-o2mhvysikbewdvuypk9kmp.ns101.veri. No SSL certificate is present, and the HTTP response returns status code 200 with the page title "solcoin.xyz". Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports two detections out of 95 scanners. The site is listed on one security blocklist and has been blocked by PhishDestroy, yet it remains reachable. The observed characteristics—crypto‑scam label, lack of encryption, and low trust score—suggest a malicious infrastructure designed to lure victims into fraudulent GoDaddy‑related interactions. Defenders should add the domain and its associated IPv6 address to network blocklists, monitor DNS queries for the listed nameservers, and consider sinkholing traffic to prevent credential harvesting. Continuous re‑evaluation is advised, as the threat actor may modify hosting or employ additional infrastructure.