liquidity[.]somnia[.]plus

The domain liquidity.somnia.plus is actively hosting a malicious site that has been classified as an investment scam. Infrastructure analysis shows the domain resolves to the IP address 198.18.0.208, which belongs to the Cloudflare network (AS13335) and is served through Cloudflare's DNS infrastructure (iris.ns.cloudflare.com, wilson.ns.cloudflare.com). The site returns an HTTP 403 status code and presents the page title "Nur einen Moment…". A valid SSL certificate issued by Google Trust Services (WE1) is present, indicating that TLS termination is handled by the CDN. The domain was registered on August 17, 2025 via PDR Ltd. d/b/a PublicDomainRegistry.com and has already appeared on a security blocklist, where it is listed by PhishDestroy. Independent scanning on VirusTotal resulted in a single vendor detection out of 95, and a Gridinsoft trust score of 0/100 further confirms its malicious nature. Although the exact content of the landing page has not been examined, the combination of a high‑risk rating, active status, and the investment‑scam classification suggests the site is designed to lure victims into fraudulent financial schemes. Defenders should block the domain at network perimeters, update URL filtering policies, and monitor for any connections to the associated IP address. Ongoing observation is recommended to detect any changes in hosting or content that could indicate escalation of the threat.