solswap[.]net

The domain solswap.net was registered on February 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently offline. Infrastructure analysis shows the domain resolves to Cloudflare nameservers clint.ns.cloudflare.com and marlowe.ns.cloudflare.com, a common pattern for fast‑flux or disposable hosting used by malicious operators. Trust metrics are extremely low: Scamadviser rates the site 1 / 100, Gridinsoft assigns 0 / 100, and the domain appears on a single security blocklist. Detection engines on VirusTotal flagged the domain in 4 of 93 scans, indicating that at least a minority of AV products recognize it as malicious.

PhishDestroy has also listed the domain as blocked, confirming its inclusion in active anti‑phishing feeds. The listed scam type is a crypto scam, suggesting the site was designed to lure victims into cryptocurrency‑related fraud, though no specific page title or content has been captured. Because the domain is offline, live HTTP response codes, SSL certificate details, and page content remain unavailable, limiting forensic depth.

Defenders should continue to block solswap.net at perimeter filters, update DNS‑sinkhole entries, and monitor for any re‑registration or similar domains using the same registrar or Cloudflare name server pair. Threat intelligence teams are advised to flag the NICENIC INTERNATIONAL GROUP CO., LIMITED registrar for heightened scrutiny, as it has been used for fast‑turnaround malicious registrations. Ongoing surveillance of related crypto‑themed domains is recommended to detect emerging campaigns that may reuse this infrastructure pattern.