solsofi[.]com

Analysis indicates that www.solsofi.com was registered on February 27, 2026 through REALTIME REGISTER B.V. and quickly surfaced as a phishing infrastructure targeting cryptocurrency users. The site presented the page title “Buy and Sell Crypto Instantly from a Bank | SoFi”, suggesting an attempt to impersonate SoFi’s financial services. DNS resolution points to the Cloudflare network (AS13335) with the address 104.21.84.32 located in the United States. Both authoritative nameservers, audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, are Cloudflare‑provided, confirming the use of a reputable content‑delivery service for hosting.

No TLS certificate was observed, indicating the site operated without HTTPS protection. VirusTotal reports a single positive detection out of ninety‑three scanning engines, and the domain appears on one external security blocklist. PhishDestroy has already taken the domain offline, and AlienVault OTX lists it in one pulse. The limited detection footprint suggests a brief campaign, but the use of a reputable CDN and a plausible page title increase the risk of user deception.

Uncertainty remains regarding the full scope of the phishing kit, the presence of malicious payloads, and whether additional infrastructure was associated with the same IP range. Defenders should block the domain and its IP at perimeter firewalls, monitor DNS queries for the two Cloudflare nameservers, and add the domain to internal blacklists. Continuous threat‑intel feeds should be consulted for any resurgence or related indicators, especially given the recent registration date and the possibility of fast‑flux reuse.