check-soneium[.]net

Analysis as of July 25, 2026 indicates that check-soneium.net was registered on 21 February 2026 and is presently offline. The domain resolves to 104.21.45.82, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The host is listed on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, confirming that multiple threat‑intelligence feeds have observed malicious activity associated with this name. VirusTotal has recorded detections from three of ninety‑three scanning engines, reinforcing the suspicion that the site was used for illicit purposes.

The TLS certificate presented on the service is identified as “WE1”, which does not correspond to a publicly trusted authority and may have been self‑signed or issued by a low‑reputation CA, a common characteristic of short‑lived phishing infrastructure. Because the site is currently taken offline, direct content inspection is not possible, and the page title, brand targeting, or specific phishing kit details remain unknown. Nevertheless, the convergence of recent domain creation, Cloudflare‑based hosting, multiple blocklist listings, and positive VirusTotal detections provides sufficient confidence to classify the domain as a generic phishing vector.

Defenders should update internal URL filtering policies to block check-soneium.net and any subdomains, enforce DNS sink‑holing for the resolved IP address, and monitor outbound traffic for connections to 104.21.45.82. Threat‑intel teams should also add the domain to indicator‑of‑compromise (IOC) feeds and correlate any user‑initiated requests with authentication logs to detect possible credential harvesting attempts. Continuous re‑evaluation is advised in case the domain is re‑activated or the hosting provider changes its content.