sondloqs[.]com

PhishDestroy first observed sondloqs.com on Nov 25, 2025. The captured page title is “sondloqs.com”. Stored page analysis classifies the content as credential phishing. Current evidence score: 98/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, DNS security resolvers, and Cloudflare Radar. VirusTotal recorded 14 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Aug 1, 2026 at 02:20 UTC. DNS security checks returned 4 blocking results across 14 tested policies: Adguard Default, Adguard Family, Cloudflare Family, Cloudflare Security; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. Non-positive and contextual checks: AlienVault OTX listed 16 community pulse references (not vendor detections) on Mar 1, 2026 at 16:35 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:22 UTC. URLScan completed without a malicious verdict on Jul 29, 2026 at 03:32 UTC. PhishStats returned no feed match on Mar 2, 2026 at 16:00 UTC.

HTTP 502 server error was recorded on Aug 7, 2026 at 22:15 UTC. Registration records for the domain list Bluehost Inc. as the registrar and Jan 27, 2015 as the creation date. At collection time, the hostname resolved to 173.254.97.74 on AS46606 (UNIFIEDLAYER-AS-1, US). The recorded endpoint location is Phoenix, US. The stored server header is nginx/1.25.5. DOM analysis on Mar 11, 2026 at 09:22 UTC returned 98/100. The evidence archive retains 3 visual captures from PhishDestroy and URLScan.

The content indicators and 3 positive source findings support the current credential phishing classification.