soneium-reward[.]life

The domain soneium-reward.life was registered on June 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure, as indicated by its authoritative nameservers tara.ns.cloudflare.com and yew.ns.cloudflare.com. Within a short window after registration, the domain surfaced on three independent security blocklists and was subsequently added to the blocklists of PhishDestroy, MetaMask, and SEAL, confirming its use in a phishing campaign. VirusTotal analysis shows that 17 out of 91 security vendors currently flag the domain as malicious, reinforcing the high‑risk assessment.

The available intelligence does not include detailed payload information, page titles, or SSL certificate specifics, so the exact phishing lure remains unconfirmed. However, the convergence of multiple blocklist entries, active blocking by reputable anti‑phishing tools, and a non‑trivial vendor detection rate collectively indicate a purposeful, high‑confidence phishing operation.

Defenders should immediately block DNS resolution for soneium-reward.life at perimeter and endpoint layers, incorporate the domain into intrusion‑prevention signatures, and monitor for any outbound connections to the associated Cloudflare nameservers. Continuous re‑evaluation is advised, as further telemetry such as HTTP response codes, page content hashes, or additional vendor detections may emerge, potentially expanding the scope of the threat.