# enter-soneium.org — SUSPICIOUS

> enter-soneium.org is a live crypto-drainer impersonating Soneium. VirusTotal score: 0/95 detections. Verify and block using PhishDestroy.

## Summary
PhishDestroy identifies enter-soneium.org as an active crypto-drainer domain designed to steal funds from Soneium users. The domain resolves to IP 104.21.61.20 and is currently propagating phishing links under the guise of Soneium branding, aiming to trick victims into connecting wallets and approving malicious transactions.  This domain exhibits high-risk indicators: VirusTotal shows 0/95 detections despite active deployment, indicating evasion of signature-based detection. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, which provides anonymity layers commonly exploited by fraudulent actors. The domain leverages IP 104.21.61.20, a known hosting provider with minimal abuse oversight, enabling rapid rotation and persistence. No Google Safe Browsing (GSB) block is currently in place, and the absence of detections suggests a recently activated campaign still below threat intelligence thresholds.  As of the latest scan, enter-soneium.org remains active with an 'under_investigation' status. Immediate action is required: security teams and users should block the domain at network and endpoint levels. PhishDestroy continues to monitor and will update classifications as new IOCs emerge. Remaining risk is assessed as moderate-to-high due to active deployment and low detection coverage, warranting urgent preventive measures.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- IP: 104.21.61.20

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- PhishDestroy: https://phishdestroy.io/domain/enter-soneium.org/
- LLM endpoint: https://phishdestroy.io/domain/enter-soneium.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/enter-soneium.org/
Last updated: 2026-03-26