satorifinance[.]info

Analysis of the domain satorifinance.info indicates active involvement in a cryptocurrency airdrop scam targeting users of the Satori platform, as evidenced by the page title 'Satori $STR Airdrop'. The domain was registered on December 10, 2025, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site employs Cloudflare nameservers (earl.ns.cloudflare.com and laura.ns.cloudflare.com) and is secured with an SSL certificate issued by Google Trust Services (WE1), leveraging HTTP/3 for communication. Despite these legitimate-seeming infrastructure components, the domain exhibits multiple indicators of malicious activity.

Security vendors have flagged satorifinance.info as suspicious, with 5 of 95 engines on VirusTotal detecting it as malicious. It appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which specialize in phishing and scam detection. The HTTP status code 525 (SSL handshake failed) may suggest misconfiguration or deliberate evasion tactics, though this is not conclusive evidence of malicious intent on its own. The domain's classification as an 'Airdrop Scam' aligns with the observed page title, which explicitly references a $STR token airdrop, a common lure in cryptocurrency fraud schemes.

Defenders should treat this domain as high-risk due to its active status, confirmed detections by security vendors, and presence on multiple blocklists. Network-level blocking of the IP 188.114.97.3 and domain-level filtering are recommended to mitigate exposure. Given the use of Cloudflare, additional scrutiny of other domains resolving to the same IP or sharing nameservers may uncover related malicious activity.