sondloqs[.]com

This domain is flagged as a credential harvesting phishing site, classified under an elevated risk level due to its historical use in targeted credential theft operations. Analysis indicates the domain was designed to mimic legitimate login portals, tricking users into submitting sensitive authentication details. The infrastructure and detection patterns align with known phishing campaigns focused on financial or corporate credential compromise. Infrastructure analysis reveals the domain sondloqs.com was registered on January 27, 2015, through Bluehost Inc. and resolves to the IP address 173.254.97.74, hosted within the United States under AS31898 (Oracle Corporation). At the time of assessment, 16 out of 95 security vendors on VirusTotal detected the domain as malicious, while it appeared on two distinct security blocklists: PhishDestroy and PhishingDB. The domain lacked an SSL certificate, further reducing its legitimacy and increasing detection likelihood. No active content was observed during the evaluation period, as the domain has since been taken offline. Mitigation measures for this threat type include implementing domain-based email filtering to block messages originating from or referencing this domain. Network security teams should ensure endpoint protection systems are configured to flag or block access to known phishing domains, particularly those with historical associations to credential harvesting. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially exposed via this domain. Security awareness training should emphasize the risks of entering login details on unverified sites, even those appearing to use familiar branding or URLs.