soktewoks[.]top

This domain, soktewoks.top, is identified as a brand impersonation threat targeting Blast, a recognized entity in the digital asset and gaming sector. Analysis indicates the site employed deceptive branding and messaging, specifically using the page title 'SOKTEWOKS | Enter the world of sport and stakes!' to lure victims into engaging with fraudulent sports betting or wagering platforms. The domain was designed to mimic legitimate Blast services, potentially harvesting user credentials, financial details, or facilitating unauthorized transactions under false pretenses. Infrastructure analysis reveals concrete technical indicators associated with this threat. The domain was registered through NameSilo, LLC on July 02, 2025, and resolved to the IP address 57.129.97.29, located in Germany under AS16276 (OVH SAS). Security vendor assessments on VirusTotal flagged the domain as malicious, with 11 out of 95 engines detecting it as a threat. The domain appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate was issued to XUI.one, a common indicator in phishing infrastructure, further corroborating its fraudulent nature. As of the latest assessment, soktewoks.top has been taken offline, reducing immediate exposure to end users. However, residual risks persist, including potential reuse of the infrastructure or registration of similar domains by the same threat actors. Organizations and users are advised to monitor for related indicators, such as the IP address 57.129.97.29, the registrar NameSilo, and SSL certificates issued to XUI.one. Proactive measures, including domain monitoring, blocklisting, and user education on recognizing brand impersonation tactics, are recommended to mitigate future threats from this campaign.