sonicrace[.]xyz

Analysis of the domain sonicrace.xyz shows a short‑lived infrastructure that was taken offline shortly after detection. The domain was registered on July 23, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 104.21.112.1, which is announced by AS13335 in the United States. The SSL certificate presented by the site is identified as WE1, indicating a standard Cloudflare‑issued certificate without additional validation. An HTTP request to the host returns the page title "Just a moment...", but no further content has been captured, and the site is currently reported as offline.

Security‑vendor scanning on VirusTotal recorded 2 positive detections out of 93 scanners, confirming that at least a minority of reputation services recognize malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public security blocklist, reinforcing the assessment of elevated risk. PhishDestroy has also blocked the domain, suggesting that it was flagged by phishing‑specific mitigation tools. The combination of a recent registration date, use of a shared Cloudflare IP, low trust score, and multiple vendor flags indicates a purpose‑built phishing operation despite the limited public footprint.

Uncertainty remains around the specific payload or credential‑harvesting mechanism, as no detailed page content or network traffic has been released. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the host on the same IP range, and consider adding the IP address to internal deny lists. Ongoing surveillance of the registrar and associated IP space is advised to catch potential re‑use of the infrastructure.