sodex-soso[.]xyz

This domain, sodex-soso.xyz, is identified as a brand impersonation phishing site targeting Sodexo, a global benefits and rewards services provider. Analysis indicates the infrastructure was designed for credential theft, likely aimed at employees or beneficiaries attempting to access corporate benefits portals. No direct evidence of a crypto drainer kit was observed, though the domain exhibits characteristics consistent with credential harvesting campaigns, including a deceptive subdomain structure mimicking legitimate Sodexo service domains. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an offshore registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3, a host with prior associations to phishing infrastructure. Detection metrics show 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by at least three endpoint protection mechanisms, including browser-based phishing filters. As of the latest assessment, sodex-soso.xyz has been taken offline, likely in response to blocklist inclusion or registrar enforcement actions. However, residual risk persists due to the domain's recent creation date and the use of a registrar with a history of delayed abuse response. Organizations are advised to monitor for related domains using similar naming conventions (e.g., sodex-[random].xyz) and implement proactive DNS filtering to mitigate potential follow-up campaigns. End users should verify domain authenticity through official channels before entering credentials.