sogo-hk[.]com

This domain, sogo-hk.com, is actively impersonating HSBC as part of a high-risk phishing campaign. Registered on December 4, 2025, through NameCheap, Inc., it resolves to IPv6 address 2606:4700:3037::6815:573b and is hosted behind Cloudflare infrastructure. The page title, 香港崇光百貨 SOGO HK - Sogo, does not match the targeted brand, suggesting deliberate obfuscation or misdirection. Analysis indicates the site employs Microsoft ASP.NET, Google Tag Manager, Google Analytics, Facebook Pixel, and reCAPTCHA, alongside HSTS for enforced HTTPS connections. Five of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on three security blocklists. ScamSniffer, PhishDestroy, and BLP-Malware have blocked it, while AlienVault OTX records its presence in 23 threat intelligence pulses. The SSL certificate is issued by Google Trust Services, which does not inherently validate legitimacy. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. Defenders should treat this domain as an active threat. Block resolution at the DNS or network level, and monitor for connections to the associated IPv6 address. Given the use of Cloudflare, direct IP-based blocking may be ineffective; focus on domain-based controls. The discrepancy between the page title and the impersonated brand (HSBC) suggests the site may pivot to other targets or payloads. No confirmed phishing kit or exact payload type has been identified, so assume credential harvesting or malware distribution until further analysis is conducted. Review logs for prior connections to this domain, particularly from endpoints accessing HSBC services.