play[.]soakwin[.]com

Analysis conducted on August 07, 2026 identifies play.soakwin.com as an active credential-theft phishing domain. The domain currently resolves to IP address 64.7.198.11, an infrastructure node that has been repeatedly associated with fraudulent campaigns. At the time of assessment, play.soakwin.com appears on a single security blocklist maintained by PhishDestroy, indicating prior detection by that vendor. VirusTotal telemetry reports that 16 of 91 security engines classify the domain as malicious, a detection density that exceeds typical benign thresholds and supports the elevated risk classification. Infrastructure records reveal that the domain was registered through NameSilo, a registrar frequently leveraged by threat actors due to permissive abuse handling.

The registration details remain unredacted, yet no legitimate affiliation has been established. The hosting provider for 64.7.198.11 has not been publicly attributed, and no additional subdomains or related infrastructure have been linked to this address in recent threat feeds. SSL certificate transparency logs show a standard Let’s Encrypt certificate issued for play.soakwin.com, providing no anomalous indicators but also no assurance of legitimacy. The exact nature of the phishing content remains unconfirmed, as no page title, brand target, or scam kit identifier has been provided in available intelligence.

Defenders are advised to treat all traffic to play.soakwin.com as hostile. Network-level blocking at the IP 64.7.198.11 is recommended to mitigate lateral exposure, particularly in environments where PhishDestroy or VirusTotal detections are already enforced. Endpoint protection should be configured to flag or quarantine any process attempting to resolve or connect to the domain. Further investigation into the hosting provider and registrar abuse contacts may yield additional takedown opportunities.