app[.]sonicpts[.]com

app.sonicpts.com is currently active and serves a page whose title reads “Just a moment…”. The domain was registered on 21 February 2026 through MAT BAO CORPORATION and is hosted behind Cloudflare, resolving to the IPv4 address 172.67.142.204 (AS13335, United States). The TLS certificate is issued by Google Trust Services under the WE1 series, indicating a valid HTTPS endpoint. VirusTotal records show that 1 of 93 security vendors have flagged the domain, and it appears on a single external blocklist; PhishDestroy also lists it as blocked. The site returns HTTP 403, and automated analysis detects the use of Cloudflare and HTTP/3 as underlying technologies. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The nameservers eth an.ns.cloudflare.com and grace.ns.cloudflare.com confirm the reliance on Cloudflare’s DNS infrastructure. While the page content beyond the title has not been publicly disclosed, the combination of a recent registration, low trust score, vendor detection, and blocklist presence strongly suggests a generic phishing operation. Defenders should block the domain at network perimeter, add the IP address 172.67.142.204 to deny lists, and monitor for any related traffic patterns, especially attempts to contact the domain over HTTPS.