sofi-inv[.]com

PhishDestroy identifies sofi-inv.com as an active crypto drainer domain engineered to mimic the legitimate Sofi Investments platform. This fraudulent site masquerades as a crypto investment portal, luring users into transferring digital assets to attacker-controlled wallets. The domain leverages brand impersonation to exploit trust in established financial services, targeting cryptocurrency holders seeking high-yield investment opportunities. This domain was flagged by a single security vendor on VirusTotal out of 95 scans, indicating limited but confirmed malicious activity. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.97.3. The domain was created on April 07, 2026, suggesting it is a recently deployed threat, likely launched during a period when new registrations receive less scrutiny. The use of a Let’s Encrypt SSL certificate adds a misleading layer of legitimacy, tricking users into believing the site is secure. If you visited sofi-inv.com, do not enter any sensitive information such as login credentials, wallet addresses, or private keys. Disconnect from the site immediately and scan your device with updated antivirus software. Review all cryptocurrency transactions for unauthorized transfers—crypto drainers often initiate rapid withdrawals to obscure theft. Report suspicious activity to your wallet provider and relevant financial authorities. Avoid interacting with any unsolicited investment links promising high returns, especially those using similar domain patterns, and use bookmarked links for legitimate financial platforms.