silo-finance-silofinance[.]net

This domain was registered on February 22 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare nameservers april.ns.cloudflare.com and kayden.ns.cloudflare.com. DNS resolution returns the Cloudflare‑owned address 104.21.55.243, which is located in the United States under AS13335. The TLS certificate presented is issued by Google Trust Services under the WE1 trust anchor, indicating a valid HTTPS endpoint. The site served over HTTP/3 and leveraged Cloudflare’s CDN infrastructure, a common choice for malicious operators seeking anonymity and rapid deployment.

Security telemetry shows that the page title returned by the server is “www.www.silo-finance-silofinance.net”, a pattern often seen in automated phishing kits. VirusTotal reports that two of ninety‑five scanners flagged the domain, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. Its current status is offline, suggesting the operators have taken the site down either after a takedown or as part of a rotation strategy. Given the combination of recent registration, Cloudflare hosting, a valid Google‑issued certificate, and detection by multiple security vendors, the domain should be treated as an elevated‑risk phishing infrastructure.

Defenders should ensure that DNS‑based blocklists are updated to include the domain, enforce outbound traffic filtering to the IP 104.21.55.243, and monitor for any re‑registration or re‑use of the same nameserver set. Continuous observation of any future TLS certificates issued for this FQDN is recommended, as a change may indicate a resurgence of malicious activity. Because the actual page content has not been examined, further sandbox analysis should be performed if the site becomes reachable again.