sobull[.]top

The domain sobull.top has been identified as a generic phishing threat, currently in an elevated risk state and taken offline. This domain attempted to impersonate a Cloudflare verification page, as indicated by its page title "Nur einen Moment…" (German for "Just a moment…"), which is commonly used by Cloudflare's JavaScript challenge. The domain was registered on November 03, 2025 through NiceNIC International Group Co., Limited, and resolved to IP address 188.114.96.3. Notably, the domain lacked an SSL certificate, which is a significant red flag for a site attempting to appear legitimate. Security intelligence shows that sobull.top appears on 1 security blocklist, and VirusTotal data indicates that 1 out of 95 security vendors flagged this domain as malicious. The low detection rate may suggest that the domain was quickly taken offline before widespread analysis could occur. Despite its current offline status, the domain's registration details and behavior point to a clear phishing operation targeting users who might encounter a fake Cloudflare challenge. Users who visited this site may have been prompted to enter sensitive information or download malicious payloads. It is strongly recommended that anyone who interacted with sobull.top run a full security scan on their devices and monitor for signs of compromise. Always verify the legitimacy of security prompts by checking the URL and SSL certificate before proceeding. PhishDestroy advises blocking this domain and any associated IP addresses to prevent future threats.