soiru[.]site

Analysis of soiru.site shows a newly registered domain created on 18 July 2026 through the HOSTINGER operations, UAB registrar. The domain resolves to the IPv4 address 162.19.249.106 and is delegated to Cloudflare name servers bill.ns.cloudflare.com and katelyn.ns.cloudflare.com. It appears on a single security blocklist and is actively listed by the PhishDestroy feed, confirming its use in malicious activity. VirusTotal records indicate that the domain has been examined by 91 scanning engines; none of the engines have raised a detection at the time of analysis, but the absence of a detection does not constitute evidence of legitimacy. The short lifespan, the association with a known blocklist, and the presence of Cloudflare‑hosted infrastructure are consistent with typical phishing‑hosting patterns. No additional intelligence such as page title, SSL certificate details, or observed payloads has been published, leaving the exact content of the site unverified. Given the confirmed blocklist entry and the registrar information, defenders should treat soiru.site as a high‑confidence phishing indicator. Recommended mitigation steps include adding the domain to DNS‑based deny lists, updating web‑proxy and firewall rules to block HTTP(S) traffic to the address, and monitoring for any future resolution changes or additional detections. Continuous re‑scanning on VirusTotal and observation of any new threat‑intel sources are advised to capture potential evolution of the campaign.