soph[.]airdropsalert[.]biz

Analysis date: July 23, 2026. The domain soph.airdropsalert.biz was registered through Dynadot LLC on October 18, 2025. It resolves to the IP address 142.250.185.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the infrastructure is fronted by Cloudflare's DNS service. The HTTP response lacks an SSL certificate, meaning the site is served over plain HTTP. The page title returned by the server is "Google", which does not correspond to the advertised brand. Threat intelligence flags the domain as a brand‑impersonation of Facebook and categorises the activity as a crypto scam.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. VirusTotal analysis shows that 16 of 95 scanning engines flag the domain as malicious, confirming a consensus of malicious intent. No additional detection vendors or Safe Browsing entries are listed beyond the blocklist and the VirusTotal count. Uncertainty remains regarding the exact payload or phishing page content, as the page title is the only visible artifact and no SSL certificate or further content analysis is available. The lack of HTTPS limits the ability to capture detailed page elements, and the offline status prevents live verification. The presence on a single security blocklist indicates that at least one external feed has recognized the domain as malicious, but the limited number of listings suggests that the infrastructure may be newly deployed or not yet widely observed.

The combination of a Google‑owned IP address and Cloudflare DNS obfuscation is a common tactic to hide malicious hosting behind reputable infrastructure.