sold-early[.]io

Analysis of sold-early.io shows a short-lived domain that was registered on February 21, 2026 through Global Domain Group LLC and subsequently taken offline. The domain resolves to IP address 170.75.161.159, which is hosted in Canada and belongs to AS174 (Cogent Communications, LLC). DNS resolution uses Cloudflare name servers sara.ns.cloudflare.com and jeremy.ns.cloudflare.com, indicating the infrastructure leveraged a reputable DNS provider but does not guarantee benign intent. No TLS certificate was observed for the domain, meaning any web traffic would have been unencrypted and vulnerable to interception.

The single page title retrieved was "Success!", providing no contextual clues about the content or purpose of the site. Threat intelligence sources classify the activity as a crypto‑related scam, and the domain appears on one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting a very low reputation. VirusTotal analysis recorded 8 detections out of 93 security vendors, confirming that multiple scanners identified malicious characteristics.

AlienVault OTX references the domain in two separate threat pulses, adding corroborating evidence of abuse. While the site is currently offline, defenders should continue to monitor the associated IP address and the Cloudflare name servers for any resurgence. Immediate actions include adding the domain and its IP to corporate blocklists, ensuring web proxies deny traffic to the host, and updating intrusion detection signatures that reference the observed indicators. Ongoing vigilance is advised because the underlying hosting provider, Cogent, serves many customers and could be reused by other malicious actors.