fixsol[.]xyz

The domain fixsol.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.189.79, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are andy.ns.cloudflare.com and marissa.ns.cloudflare.com, and the site was served over HTTPS using a Google Trust Services certificate issued to WE1, indicating a valid TLS chain. Network traffic was observed using HTTP/3, consistent with Cloudflare’s edge services.

The page title returned by the now‑offline site was “SolReFix | Blockchain support,” which aligns with the classified scam type of a crypto‑related phishing operation. Security‑vendor intelligence shows the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and a Gridinsoft trust score of 0 out of 100. VirusTotal analysis recorded 13 detections out of 95 scanned scanners, reinforcing the malicious assessment. The combination of recent registration, Cloudflare front‑end, low trust score, blocklist listings, and multiple vendor flags indicates that the domain is being used for a crypto‑scam phishing campaign, despite its current offline status.

Uncertainty remains regarding the exact content that was served before takedown, as no visual or functional details have been captured. Defenders should continue to block traffic to 172.67.189.79 when associated with fixsol.xyz, add the domain to internal URL filtering and email protection lists, and monitor for any re‑appearance on alternative hosting providers. Ongoing correlation with threat‑intel feeds is advised to capture possible repurposing of the same infrastructure for future campaigns.