app[.]soakwin[.]com

As of August 07, 2026, the domain app.soakwin.com has been identified as active phishing infrastructure with an elevated risk profile. Analysis indicates 13 out of 91 security vendors currently flag this domain as malicious according to VirusTotal intelligence. The domain is also listed on at least one security blocklist and has been blocked by PhishDestroy, strengthening the evidence of its association with phishing activity. The domain resolves to IP address 172.67.221.115.

There is currently no confirmed information regarding the specific content or impersonated service, as neither the website title, scam type, nor a targeted brand have been identified in the available data. As such, defenders should treat this domain as a generic phishing threat. The continued active status, coupled with multiple independent detections, suggests this infrastructure is being employed for malicious purposes. Organizations are strongly advised to monitor network activity for connections to this domain, block it across perimeter security controls, and search security logs for historical access.

Pending further investigation into its specific tactics and targets, defenders should maintain heightened vigilance around any traffic to or from app.soakwin.com and its associated IP address. The exact methods by which users are lured or what data is targeted remain unknown at this point. Continued intelligence gathering is recommended to determine the full scope of the threat posed by this domain.