sonar[.]echodot[.]xyz

This report analyzes the domain sonar.echodot.xyz, which was configured as a fake exchange site. The page title, "Sonar Setup — Echo," indicates it was designed to impersonate the Sonar and Echo brands, likely to trick users into providing login credentials or financial information under the guise of account setup. The primary threat is credential theft and potential financial loss through a fraudulent exchange platform.

Technical evidence confirms the site's malicious nature. VirusTotal detected it as malicious by 3 out of 95 security vendors, with specific flags from alphaMountain.ai and Forcepoint ThreatSeeker. It appears on 4 blocklists. The domain was registered through NameSilo, LLC on 2025-10-27, hosted at IP address 162.254.39.138 (United States, Namecheap, Inc.), and uses nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com. No SSL certificate was present, indicating no encryption for data transmission.

The domain is currently offline and unreachable. With a GridinSoft trust score of 0 out of 100 and a DOM risk score of 63, the risk level is assessed as high. The combination of short registration age, lack of SSL, and multiple security flags strongly supports its classification as a malicious fake exchange site.