soukglam[.]com

This domain, soukglam.com, is under investigation for credential theft phishing activity targeting users through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure suggests a generic credential harvesting operation. The domain was designed to mimic legitimate services, likely to capture sensitive user credentials such as usernames, passwords, or multi-factor authentication codes. Infrastructure analysis reveals the domain was registered on April 15, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 188.114.96.3 and currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious at this time. The domain appears on a single security blocklist and is blocked by one known security provider. It employs a Let's Encrypt SSL certificate and utilizes technologies including HSTS, Cloudflare, and HTTP/3, which are commonly used to enhance security but may also obscure malicious activity. The Gridinsoft trust score for this domain is 0/100, reflecting high suspicion. As of the latest assessment, soukglam.com has been taken offline, reducing immediate exposure risk. However, the domain remains under investigation due to its recent registration and association with credential theft infrastructure. Organizations are advised to monitor for related indicators of compromise, including the IP address 188.114.96.3 and any subdomains or redirects linked to this domain. Network-level blocking of the domain and its resolved IP is recommended as a precautionary measure. Users should be educated on recognizing phishing attempts, particularly those leveraging fake login pages or urgent authentication requests.