soleraonline[.]icu

Analysis of soleraonline.icu indicates that the domain is actively being used for a generic phishing operation. The site presents the page title "Just a moment..." and returns an HTTP 403 status, suggesting that the content is being gated or shielded behind a challenge. Infrastructure checks show the domain is hosted on Cloudflare, resolving to IP 104.21.63.203, which is located in Canada and is associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming that TLS termination is performed by Cloudflare’s edge network. Registration data lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the authoritative name servers are jen.ns.cloudflare.com and yichun.ns.cloudflare.com. The domain has been added to the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal reports four detections out of ninety‑one scanners, reinforcing the malicious assessment. While the exact phishing payload, target brand, or credential‑harvesting mechanism has not been observed, the combination of a generic phishing classification, active blocklist entries, and multiple vendor detections warrants a high‑risk rating. Defenders should block the domain at the DNS and firewall layers, monitor outbound connections to the associated IP, and consider adding the domain to internal threat‑intel feeds. Continuous re‑inspection of the URL for any changes in content or certificate details is recommended.