sophonevm[.]xyz

The domain sophonevm.xyz is identified as a credential-harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though it previously hosted content designed to mimic legitimate authentication portals for the purpose of stealing user credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic phishing campaigns aimed at broad credential theft. Infrastructure analysis reveals the domain was registered on June 09, 2025, through NameSilo, LLC, and resolves to the IP address 188.114.97.3. Security vendor assessments show that 3 of 95 VirusTotal engines flagged the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and was actively blocked by PhishDestroy. The page title, 'Just a moment...,' suggests the use of evasion techniques such as Cloudflare or similar proxy services to obscure backend infrastructure. Given the domain's current offline status, immediate risk to end users is reduced. However, the infrastructure remains a potential threat vector. Organizations are advised to maintain blocklist entries for sophonevm.xyz and its associated IP (188.114.97.3) in perimeter security controls. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window. Continuous monitoring for re-activation or related domains registered through the same registrar is recommended.