soniclabs[.]asia

Analysis on soniclabs.asia, observed as offline as of 24 July 2026, indicates a recently registered domain used for generic phishing. The domain was created on 9 July 2025 through Web Commerce Communications Limited and is hosted on Cloudflare infrastructure (AS13335) with the IPv6 address 2606:4700:3031::6815:5e6 located in the United States. Two of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single security blocklist, currently blocked by PhishDestroy. The domain resolves to Cloudflare nameservers cheryl.ns.cloudflare.com and yisroel.ns.cloudflare.com and does not present an SSL certificate, leaving HTTP connections unencrypted.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The only page content retrieved before takedown was a title reading “Just a moment…”, providing no indication of the targeted brand or the phishing payload. Because the site is offline, active content cannot be examined, and the specific victim lure remains unknown. No TLS certificate was detected, meaning the site did not encrypt traffic, which is atypical for legitimate services and further supports malicious use.

The lack of visible branding or login forms in the captured title prevents attribution of a specific target, so threat actors may be employing a disposable site to host credential‑stealing redirects or malicious downloads. Defenders should continue to block the IPv6 address and the domain at perimeter filters, update URL and domain reputation feeds with the observed indicators, and monitor for any re‑registration attempts using the same registrar or similar naming patterns. Additional hunting can focus on traffic to the associated Cloudflare edge nodes and any other domains sharing the same IP block that exhibit similar trust‑score or blocklist status.