sopin[.]icu

The domain sopin.icu, previously targeting MetaMask users, is now offline. Despite its current status, it was flagged as malicious by 7 out of 95 vendors on VirusTotal, indicating its potential threat level during its active period. This domain was also listed on three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL.

Registered through Web Commerce Communications Ltd and hosted on an IP associated with CloudFlare, Inc., sopin.icu had an SSL certificate issued by Google Trust Services. These details suggest a level of sophistication in the domain's setup, potentially aimed at deceiving users into believing the site was legitimate.

The phishing operation behind sopin.icu likely sought to exploit MetaMask users, a popular target for scammers due to the platform's widespread use in cryptocurrency transactions. By mimicking legitimate services, such domains can trick users into divulging sensitive information, such as private keys or account credentials. Even though the domain is currently offline, its presence on multiple blocklists underscores the importance of proactive threat detection and timely response to emerging phishing threats.