sonitix[.]io

sonitix.io was registered on 18 September 2025 through Web Commerce Communications Limited. The domain resolves to the Cloudflare edge address 172.67.194.66, located in the United States and announced by AS13335 Cloudflare, Inc. DNS is served by carl.ns.cloudflare.com and evelyn.ns.cloudflare.com, and the site employed Cloudflare and HTTP/3 for transport. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming that encryption is terminated at Cloudflare. The only visible page title, “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Sonitix”, indicates a cryptocurrency‑exchange façade that is unrelated to the legitimate brand 1inch, which is listed as the impersonated target.

The domain is classified as a brand‑impersonation scam and currently returns HTTP 403, confirming that the site is offline but still reachable for analysis. VirusTotal scans show that six of ninety‑five security engines flag the domain as malicious, and at least one external blocklist has listed it. Additional reputation signals include a Gridinsoft trust score of 1 out of 100 and a block by the PhishDestroy service. These combined indicators point to a high‑confidence malicious infrastructure aimed at deceiving users of the 1inch platform.

Defenders should add 172.67.194.66 and the domain name to firewall and DNS blocklists, monitor for any future re‑hosting on different IP ranges, and employ brand‑monitoring tools to detect similar impersonation attempts. Because the site is presently offline, any active phishing payloads are not observable, and further investigative steps such as content capture or sandbox execution are not applicable. Continuous review of Cloudflare‑associated abuse reports is recommended, as the attacker may spin up new sub‑domains or reuse the same registrar to evade detection.