claim[.]sosofi[.]xyz

On July 29, 2026, the domain claim.sosofi.xyz was observed operating as a crypto‑drainer infrastructure. The site is currently classified as active with an elevated risk rating. Threat intelligence sources indicate that the domain appears on a single security blocklist and has been flagged by eight of ninety‑one VirusTotal‑registered scanners, demonstrating a moderate level of detection across the security community.

Additionally, the anti‑phishing service PhishDestroy has listed the domain as blocked, further confirming its malicious use. No public information about the domain’s registrar, hosting IP address, SSL certificate details, HTTP response codes, or Safe Browsing status is presently available, and the page title returned by the site has not been disclosed. Consequently, the exact infrastructure layout and the specific cryptocurrency wallets targeted remain unknown.

Analysts recommend that network defenders immediately add claim.sosofi.xyz to DNS‑ and URL‑filtering policies, enforce outbound traffic controls to prevent connections to the host, and monitor for any related hash or command‑and‑control indicators that may emerge. Continuous re‑evaluation of threat feeds is advised, as additional detection signals or blocklist entries may surface, enabling a more comprehensive mitigation strategy.