explorer-somnia[.]network

This domain, explorer-somnia.network, is flagged as an active high-risk phishing infrastructure registered on February 21, 2026, through OwnRegistrar, Inc. Analysis indicates the domain resolves to IP address 172.67.181.219, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used to conceal malicious origins. The site currently returns an HTTP 403 status with the page title 'Just a moment...', a generic response often associated with Cloudflare's security challenge or interstitial pages, which may indicate an attempt to filter or delay access to the actual phishing content. Infrastructure assessment reveals the domain employs Cloudflare's nameservers (gracie.ns.cloudflare.com and patrick.ns.cloudflare.com) and utilizes HTTP/3, a protocol choice that can complicate traffic inspection and detection efforts. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious classification. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is flagged by 6 out of 95 security vendors on VirusTotal, reinforcing its high-risk status. While the exact phishing campaign or targeted brand remains unconfirmed due to the lack of visible content, the domain's creation timeline, hosting infrastructure, and detection by multiple security vendors suggest it is part of an active phishing operation. Defenders are advised to block the domain at the DNS or network level, monitor for related indicators such as the IP address 172.67.181.219, and investigate any connections from internal systems. Given the domain's reliance on Cloudflare, additional scrutiny of traffic patterns and certificate transparency logs may be necessary to identify further compromised or malicious domains sharing the same infrastructure.