soph[.]airdrpsalerts[.]life

The domain soph.airdrpsalerts.life is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting Google. The site presents a page title of "Google," which aligns with the declared brand target. Infrastructure analysis shows the domain resolves to IP address 142.250.181.228, an address owned by Google LLC (ASN 15169) located in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, further reinforcing the appearance of legitimacy.

Registration data indicates the domain was provisioned through Cloudflare, Inc., and the underlying hosting utilizes Cloudflare services with HTTP/3 enabled. An HTTP request to the site returns a 502 status code, suggesting a gateway error or intentional disruption of normal traffic. The domain has been added to one security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis reports that 10 of 95 scanned security vendors flag the domain as malicious, providing additional corroboration of its abusive nature.

Nameserver information is not publicly disclosed. While the observed indicators confirm a concerted attempt to impersonate Google and exploit trusted TLS credentials, the exact content served to end‑users remains unverified. Defenders should block the domain at network perimeter devices, update URL filtering policies to include soph.airdrpsalerts.life, and monitor for any outbound connections to the associated IP address. Continuous re‑evaluation is advised, as the 502 response may change if the underlying infrastructure is reconfigured.