soxugamb[.]com

This domain, soxugamb.com, is identified as a high-risk cryptocurrency phishing infrastructure designed to harvest wallet credentials and drain digital assets. Analysis indicates it operates as a generic phishing site, likely impersonating legitimate wallet services or decentralized application interfaces to deceive users into submitting private keys or seed phrases. No specific brand impersonation has been confirmed, but the domain exhibits characteristics consistent with wallet-drainer kits, including script-based credential interception and automated transaction redirection to attacker-controlled addresses.

Technical indicators confirm the domain was registered on May 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. As of the latest assessment, it is flagged by 9 out of 95 security vendors on VirusTotal, with detections spanning heuristic analysis, behavioral signatures, and known phishing patterns. The domain appears on three independent security blocklists, including at least one specialized in cryptocurrency threats. Infrastructure analysis reveals no association with Google Safe Browsing at the time of reporting, though this status may change dynamically. The domain remains resolvable and hosts active content, suggesting ongoing malicious operations.

Current status is classified as active, with no evidence of takedown or mitigation at the registrar or hosting level. Users are advised to block the domain at the network or endpoint level and avoid interaction with any associated URLs or subdomains. Organizations should update detection rules to include this domain in phishing and cryptocurrency-related threat feeds. Given the high-risk classification and persistence of the infrastructure, continued monitoring is recommended to track potential shifts in hosting, IP associations, or impersonation tactics. The remaining risk remains elevated due to the domain's active status and lack of enforcement action against its operators.