psols[.]cc

Analysis of the domain psols.cc indicates active malicious activity targeting cryptocurrency users. The site was registered on February 21, 2026 through Global Domain Group LLC and is hosted on Cloudflare infrastructure (ASN 13335, United States). DNS resolution points to IP address 104.21.66.101, which is part of Cloudflare’s network and presents the HTTP/3 protocol alongside Cloudflare Browser Insights. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid HTTPS endpoint despite the underlying threat. An HTTP 403 response is returned for the root request, and the page title reported by the scanner is "Just a moment...".

Gridinsoft’s proprietary trust scoring assigns the domain a rating of 1 out of 100, reflecting extreme risk. VirusTotal analysis shows that 4 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple anti‑phishing and cryptocurrency‑wallet protection services have identified it as a threat. The identified scam type is a crypto scam, consistent with the observed blocking by MetaMask.

While the exact phishing payload or credential‑stealing mechanisms have not been captured, the combination of low trust score, vendor detections, blocklist presence, and the "Just a moment..." title suggests a typical credential‑harvesting or wallet‑draining page. Defenders should add psols.cc to URL filtering policies, enforce DNS blocklists that include the observed entries, and monitor outbound connections to the associated Cloudflare IP. Network sensors should flag any HTTP/3 traffic to 104.21.66.101, and endpoint security solutions should treat the domain as high‑risk based on its current classification. Continuous re‑scanning is recommended to capture any changes in payload or hosting configuration.