sosafe[.]fi

This domain, sosafe.fi, is flagged as an active high-risk phishing site targeting users of the SoSafe E-Learning platform. Infrastructure analysis reveals the domain was registered on July 31, 2025, through Gandi SAS and currently resolves to IP address 51.116.145.45. The page title, 'Anmeldung - SoSafe E-Learning,' directly indicates an attempt to mimic a legitimate SoSafe login portal, suggesting credential harvesting as the primary objective. The SSL certificate is issued by DigiCert Inc, which may lend superficial legitimacy but does not mitigate the threat. The domain appears in two AlienVault OTX threat intelligence pulses, confirming its association with malicious activity. While only 2 of 95 security vendors on VirusTotal have flagged the domain, this limited detection does not indicate safety, as phishing domains often evade initial scans. Defenders should treat this domain as hostile and prioritize blocking it at DNS, proxy, and endpoint levels. Given the domain's recent registration and active status, monitoring for related infrastructure (e.g., subdomains, adjacent IPs) is recommended to identify potential campaign expansion. The exact phishing kit or backend infrastructure remains unconfirmed, and further analysis of network traffic or hosting environment may reveal additional indicators.