soph[.]airdrpsalerts[.]xyz

This domain, soph.airdrpsalerts.xyz, was observed serving a Google‑brand impersonation page with the title “Google”. The domain was registered on 4 November 2025 through Dynadot LLC and resolves to the IP address 172.217.18.4, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS. No TLS certificate was presented, meaning the site was reachable only over HTTP.

The site has been taken offline at the time of reporting, and its current status is recorded as “offline”. Detection data show that the domain appears on one security blocklist and is listed as blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded four detections out of ninety‑five scanners, reinforcing the suspicion.

The campaign is classified as a brand impersonation targeting Google users. Defensive recommendations include adding the domain and its IP address to network deny lists, updating URL filtering rules to block any HTTP request to soph.airdrpsalerts.xyz, and monitoring DNS queries for the associated Cloudflare name servers. Incident responders should also correlate logs for traffic to 172.217.18.4 during the active window and consider sinkholing the IP if feasible. Continuous re‑evaluation is advised, as the infrastructure may be repurposed for future impersonation attempts.