https://sonicrefs.su/
104.21.3.150 · Cloudflare, Inc.
Toronto, Canada
—
200 · 19.4s
Valid· WE1, Google Trust Services, US
COMPLETED
No KB/IOK detections were recorded for this scan.
finance | ecommerce | technology | payments · 4/5/2026
This site at sonicrefs.su presents itself as a real service branded Sonic Refunds, claiming to be the #1 Refund Service Worldwide. The page title, meta tags, and visual assets strongly impersonate a legitimate refund service, while the domain does not belong to the brand (sonicrefs.su vs a likely legitimate Sonic Refunds domain). The SPA loads multiple JS assets and fonts, suggesting dynamic credential capture via client-side code. The presence of Cloudflare infrastructure and a modern SPA architecture further indicates an intent to harvest user data under a trusted-appearing brand facade.
Scanner observed the live page rendering Sonic Refunds branding within a domain not controlled by the brand. The page uses a SPA with external JavaScript bundles likely designed to capture credentials, and the static HTML contains no forms, indicating credential harvesting via JavaScript. The domain sonicrefs.su is unrelated to the legitimate Sonic Refunds domain and employs Cloudflare, suggesting attempt to evade basic scans while delivering an impersonation to real users. The SSL certificate is recently issued and active for a short period, which increases risk. This constitutes high-risk credential phishing targeting users of a known refund service; abuse teams should treat this as impersonation and immediate takedown-worthy.
Monitor