# PhishDestroy threat dossier — sonnik.dev ================================================================ Fetched: 2026-07-28 18:41:51 UTC Canonical: https://phishdestroy.io/domain/sonnik.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 99/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: Bfore.Ai PreCrime, SOCRadar, Webroot AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.23.78 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Hosting Concepts B.V. d/b/a Registrar.eu Nameservers: ["john.ns.cloudflare.com", "ophelia.ns.cloudflare.com"] Page title: Sonnik Soluções Tecnológicas - Tecnologia, Inteligência e Automação HTTP response: 307 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-14 Status: INVALID chain Fingerprint: 7044c44e9634c776087c203cc75b222fc15694624a596fed69094f302865711f Subject Alternative Names (related infrastructure — often same operator): - cnpj.sonnik.dev ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-28 08:33:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-28 16:20:19 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 08:34:57 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is sonnik.dev a Scam? The domain sonnik.dev is currently registered through Hosting Concepts B.V. operating under the brand Registrar.eu. Its authoritative DNS is hosted by Cloudflare, using the name servers john.ns.cloudflare.com and ophelia.ns.cloudflare.com. The domain remains active as of the report date, July 28 2026, and returns an HTTP 307 temporary redirect status for inbound requests, a response often leveraged to steer victims toward malicious payloads or credential‑harvesting pages. Observational data indicates that sonnik.dev is listed on a single security blocklist, where it is actively blocked by the PhishDestroy service. VirusTotal has recorded three positive detections out of ninety‑one scanned security vendors, confirming that at least a subset of automated scanners have identified malicious characteristics associated with the domain. No additional public reputation scores, safe‑browsing verdicts, or Open Threat Exchange (OTX) entries are presently available for this indicator. The evidence set therefore supports a high‑risk classification for the domain, consistent with the generic phishing threat type noted in internal intelligence. However, the limited number of detections and the singular blocklist entry leave some uncertainty regarding the full scope of the campaign, such as the specific phishing lures employed, the hosting infrastructure beyond Cloudflare, and any associated command‑and‑control endpoints. Defenders should therefore prioritize blocking sonnik.dev at network perimeters and DNS resolvers, monitor for any outbound connections to the domain, and incorporate the domain hash into endpoint detection and response (EDR) signatures. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 361f544537e67e3e327d943fda651800 TLS cert SHA-256: 7044c44e9634c776087c203cc75b222fc15694624a596fed69094f302865711f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/sonnik.dev/ JSON API: https://api.destroy.tools/v1/check?domain=sonnik.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 212,649 domains (87,078 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io