app-soneium[.]xyz

This domain, app-soneium.xyz, operates as a crypto wallet drainer designed to steal credentials and siphon digital assets from unsuspecting users. Analysis indicates the site mimics legitimate wallet interfaces, tricking visitors into entering private keys or seed phrases, which are then harvested by threat actors. The infrastructure is optimized for rapid credential capture and fund exfiltration, typical of high-velocity phishing campaigns targeting cryptocurrency holders. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 13, 2026, through Dynadot LLC, a registrar frequently abused for phishing operations. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, while it appears on four distinct security blocklists. The site resolves to IP address 188.114.96.3 and employs Cloudflare with HTTP/3, a configuration often used to obscure backend servers and evade detection. The SSL certificate issued by Let’s Encrypt further masks the site’s true intent, as automated certificate issuance is commonly exploited in phishing campaigns. Users who visited app-soneium.xyz should assume their wallet credentials or private keys may have been compromised. Immediate action is required: revoke any active sessions, transfer remaining funds to a new wallet, and monitor transaction histories for unauthorized activity. If credentials were entered, consider all associated accounts and assets at risk. Additionally, report the domain to relevant security teams and blocklists to prevent further exploitation. Proactive measures, such as hardware wallet adoption and multi-factor authentication, are recommended to mitigate future risks.