soil-updates[.]live

The domain soil-updates.live is flagged as a high-risk credential phishing site. As of July 12, 2026, the domain remains active and is currently blocked by PhishDestroy. The page title displayed when accessing the domain is 'Just a moment...', which could be an attempt to mask the true nature of the site or a generic placeholder. Infrastructure analysis reveals that the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses Cloudflare's nameservers, indicating a potential use of CDNs to obfuscate the origin. The domain resolves to the IP address 172.67.198.24, which is located in California, USA, and is associated with Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt, which is common for both legitimate and malicious sites. The domain was created on April 11, 2026, and has been identified in one threat intelligence pulse on AlienVault OTX. One security vendor has flagged this domain as malicious, suggesting that it is being actively monitored by security researchers. Defenders should block this domain and monitor network traffic for any attempts to access it, as it poses a significant risk of credential theft. Further analysis of the exact content and targets of the phishing site is recommended to understand the full scope of the threat.