sorttools[.]xyz

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, sorttools.xyz, operates as a credential harvesting portal under the guise of an Online Active Connect service. Analysis indicates the site is designed to deceive users into submitting sensitive authentication details, likely targeting corporate or cloud service credentials. The page title, Online Active Connect, suggests an attempt to impersonate legitimate remote access or identity verification systems, a common tactic in phishing campaigns aimed at enterprise environments. Infrastructure analysis reveals multiple red flags supporting the malicious classification. The domain was registered on April 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and is currently offline, though prior activity was detected. Security vendors on VirusTotal flagged the domain at a rate of 5 out of 95, indicating moderate but consistent detection across threat intelligence platforms. Additionally, the domain appears on two security blocklists, further confirming its malicious intent. Technologies detected include Framer Sites, React, HSTS, and Cloudflare Browser Insights, which may be leveraged to enhance the site's legitimacy and evade basic detection mechanisms. Users who visited sorttools.xyz should take immediate action to mitigate potential compromise. If credentials were entered, they must be changed across all platforms where reused, with priority given to work-related or financial accounts. System scans using updated security tools are recommended to detect any secondary payloads or persistent threats. Browser data, including cookies and cached credentials, should be cleared to remove any residual artifacts. Organizations should review authentication logs for unusual access patterns and consider implementing multi-factor authentication if not already in place. Given the elevated risk level, monitoring for phishing-related incidents should be heightened for at least 30 days following exposure.