soneium-reward[.]top

Analysis of soneium-reward.top shows that the domain was registered on June 07, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are gwen.ns.cloudflare.com and pablo.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The domain has been added to three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms. VirusTotal scans have returned detections from six of ninety‑one AV engines, confirming that multiple security products consider the site malicious.

The limited detection footprint, combined with the recent creation date, suggests a short‑lived infrastructure typical of opportunistic generic phishing campaigns. No public evidence of SSL certificates, HTTP response codes, or page content has been released, so the exact payload or credential‑harvesting mechanisms remain unknown. At present, no public evidence of the site's landing page or targeted brand has been disclosed, limiting attribution of the specific phishing scenario. Defenders should add soneium-reward.top to network‑level deny lists, enforce DNS filtering that includes the blocklists where the domain appears, and monitor for any outbound connections to the Cloudflare name servers associated with this domain.

Continuous re‑scanning on VirusTotal and similar aggregators is recommended to capture any changes in detection status. Organizations that rely on MetaMask or other crypto wallet extensions should verify that their extension blocklists remain up‑to‑date, as the domain is already flagged by MetaMask. Given the elevated risk rating, the domain should be treated as high priority for remediation. In summary, the observable indicators—registrar information, Cloudflare name servers, blocklist entries, and multi‑engine detections—provide sufficient confidence to treat soneium-reward.top as a malicious phishing resource and to implement preventative blocking.