somnia[.]forum

Analysis indicates that somnia.forum is an active generic phishing infrastructure. The domain resolves to 104.21.33.99, a Cloudflare edge node located in Canada, and uses Cloudflare’s DNS with authoritative nameservers danica.ns.cloudflare.com and randy.ns.cloudflare.com. Registration was performed through Porkbun LLC, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 hierarchy, suggesting legitimate TLS termination. An HTTP GET returns status 200 and the page title “Just a moment…”, which is typical of Cloudflare’s interstitial challenge page; no additional content has been captured. VirusTotal reports two detections out of 91 scanners, and the domain is listed on the PhishDestroy blocklist, confirming external confidence of malicious use. The limited visible indicators do not reveal the specific brand or service being spoofed, and the page’s internal structure has not been publicly disclosed, leaving the exact phishing vector uncertain. Defenders should proactively block somnia.forum at the DNS or firewall level, add it to internal phishing blocklists, and monitor for any related C2 traffic or credential submission attempts. Continuous re‑inspection of the site’s content is advised to capture any future changes that could reveal the targeted brand or payload.