soiaxy[.]com

Analysis indicates that the domain soiaxy.com was registered on February 21, 2026 through Hello Internet Corp and is currently hosted on IP address 104.168.69.100, which belongs to AS36352 operated by HostPapa in the United States. The site presents the page title “Bitcoin Hyper BTC Layer 2 | Best Crypto Presale To Buy Now” and is classified as a brand impersonation campaign targeting the Bitcoin brand. No SSL certificate is observed for the domain, meaning the site is served over plain HTTP. The domain appears on five independent security blocklists and is actively blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, indicating consensus among multiple threat‑intelligence feeds.

VirusTotal reports three detections out of ninety‑five scanning engines, providing additional confirmation of malicious intent. Nameserver records point to ram.ns.cloudflare.com and teagan.ns.cloudflare.com, which are typical of Cloudflare‑managed domains but do not mitigate the observed abuse. The hosting infrastructure resides in the United States under AS36352, and the IP address is presently taken offline, reducing immediate exposure but still warranting monitoring in case the server is re‑activated. The available evidence does not include a detailed content review beyond the page title, so the specific tactics employed on the landing page remain uncertain.

Defenders should add soiaxy.com to URL filtering rules, block the associated IP address, and monitor DNS queries for the domain and its nameservers. Continuous inspection of traffic to the hosting ASN and periodic re‑scanning with VirusTotal or similar services are recommended to detect any future re‑deployment. Because the domain impersonates Bitcoin, security teams should also alert users and stakeholders in cryptocurrency‑related services to the potential credential‑harvesting risk.