app-soniclabs[.]icu

The domain app-soniclabs.icu was registered on December 22, 2025 through HOSTINGER operations, UAB and is hosted on the IP address 84.32.84.122, which belongs to AS47583 Hostinger International Limited in Lithuania. The domain resolves to the same IP and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No SSL certificate is presented for the site, and the Gridinsoft trust score is 0 out of 100, indicating a complete lack of trustworthiness. VirusTotal analysis shows that nine out of ninety‑three security vendors flagged the domain, confirming malicious activity.

The listed scam type is brand impersonation targeting CoinMarketCap, and the page title served at the host – “Sonic (S) Testing Key Resistance – Could This Pattern Trigger an Upside Breakout?” – bears no relation to the advertised brand, further supporting the impersonation hypothesis. The domain appears on a single security blocklist and is currently blocked by PhishDestroy, which has taken the site offline. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the combined evidence of a zero trust score, lack of encryption, vendor detections, and blocklist inclusion strongly suggests a phishing or credential‑stealing campaign masquerading as CoinMarketCap.

Defenders should continue to monitor for any resurgence of the domain, enforce URL filtering to block resolution to 84.32.84.122, and update endpoint and web‑gateway rules to flag any traffic to app-soniclabs.icu. Organizations that rely on CoinMarketCap services should educate users about the illegitimate domain and advise them to verify URLs before entering credentials. Additional analysis of the HTTP response body and any associated payloads is recommended to determine the full scope of the threat.