pholon-sol[.]app

On July 22, 2026 the domain pholon-sol.app was observed in an elevated‑risk brand‑impersonation campaign targeting the brand “base”. The site presented the page title “Photon – Your Trusted Platform for Token Discovery & Trading”, a title that bears no obvious connection to the advertised brand, suggesting the title is being used to attract cryptocurrency‑interested victims. Registration data indicates the domain was registered through Web Commerce Communications Limited, and the authoritative name servers are kobe.ns.cloudflare.com and luciana.ns.cloudflare.com, both hosted on Cloudflare’s network (ASN 13335). DNS resolution points to IP address 104.21.16.1, which is located in the United States and is part of Cloudflare’s edge infrastructure. No TLS certificate was observed for the domain, meaning the site would have been served over plain HTTP, a characteristic often leveraged to simplify credential harvesting.

The domain has been flagged by multiple external threat feeds: PhishDestroy and ScamSniffer have added it to their blocklists, and it appears on two additional security blocklists. VirusTotal analysis shows that one out of ninety‑five scanners raised a detection, reinforcing the suspicion of malicious intent. The Gridinsoft trust score of zero further confirms that the host is considered completely untrusted. The campaign is classified as wallet/seed phishing, indicating that the adversary likely attempts to collect private keys, seed phrases, or other cryptocurrency wallet credentials. Because the domain is currently offline, active exploitation cannot be confirmed, but the infrastructure footprint remains usable for future re‑deployment.

Defenders should continue to block the domain at perimeter firewalls, DNS resolvers, and proxy layers. Incident response teams should monitor for any attempts to contact the domain or resolve its IP, and should consider adding the associated IP address 104.21.16.1 to deny‑list rules.