soiflare[.]fi-v2[.]to

The domain soiflare.fi-v2.to has been confirmed as a crypto drainer phishing site, designed to steal cryptocurrency wallet credentials and drain funds through malicious scripts. Analysis indicates the domain is currently offline, though it remains a documented threat due to its recent activity and infrastructure. Infrastructure analysis reveals the domain was registered on November 17, 2025, through the Government of the Kingdom of Tonga registrar. It resolves to the IP address 172.67.172.31, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate and has been flagged by 17 out of 95 security vendors on VirusTotal. Additionally, it appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. The page title, matching the domain name, further suggests an attempt to mimic legitimate services or deceive users. At present, soiflare.fi-v2.to is offline, though its infrastructure and historical activity warrant continued monitoring. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with the site should immediately revoke any wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Security teams should treat any residual DNS or proxy traffic to this domain as a potential compromise indicator.