wer[.]solvault[.]ws

This domain wer.solvault.ws was registered on 21 February 2026 and is presently taken offline. Threat intelligence classifies the site as an investment‑scam phishing operation. The domain appears on a single security blocklist and is blocked by the PhishDestroy service. Gridinsoft assigned a trust score of zero out of one hundred, indicating a complete lack of trust.

VirusTotal analysis reports that three of ninety‑five scanning engines flagged the domain as malicious, confirming its association with malicious activity. The low detection count suggests limited exposure, but the presence of any detections aligns with the identified scam type. No additional infrastructure details such as hosting IP, ASN, or SSL certificate information are available in the current dataset, leaving the underlying hosting environment uncharacterised. The absence of further public sightings and the offline status limit the ability to assess the payload or credential‑harvesting mechanisms that may have been employed.

Defenders should continue to monitor blocklist feeds for any re‑appearance of the domain, ensure that internal web filtering solutions block wer.solvault.ws, and consider adding the domain to custom deny lists across email gateways and endpoint protection platforms. Organisations that have observed related investment‑scam communications should treat any emails referencing wer.solvault.ws as malicious and advise users to avoid interaction. Ongoing vigilance is recommended, as the threat actor may recycle the domain or shift to similar‑named infrastructure in future campaigns.