sophon[.]airdropsalert[.]xyz

Domain sophon.airdropsalert.xyz was registered through Dynadot LLC on 17 October 2025. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to IP address 142.250.185.68, which is assigned to AS15169 Google LLC and geolocated to the United States. No TLS certificate was presented, meaning the site only served HTTP traffic. Gridinsoft assigned a trust score of 0 out of 100, indicating a malicious reputation. The page title returned by the server is “Google”, and the domain explicitly impersonates Google, targeting the brand for a crypto‑scam campaign as indicated by the “Crypto Scam” tag in the intelligence feed.

VirusTotal analysis recorded 12 detections out of 95 scanning engines, confirming that multiple security vendors consider the domain malicious. The site appears on a single external blocklist, currently PhishDestroy, which has taken the domain offline. No additional public blocklists, Safe Browsing entries, or OTX references were reported. Because the domain is presently taken offline, direct content inspection was not possible, leaving the exact phishing page layout and credential‑stealing mechanisms unknown.

Defenders should immediately add sophon.airdropsalert.xyz to network and email denylists, enforce DNS‑level blocking, and monitor for any future resolution to the same IP address or reuse of the Cloudflare nameservers. Given the association with a high‑profile brand and the low trust score, threat‑intel teams ought to watch for other domains registered by the same registrar within the same timeframe that resolve to Google‑owned IP space. Continuous re‑scanning on VirusTotal or similar platforms is advised to detect any changes in the detection landscape. The lack of HTTPS and the presence on a known blocklist suggest that the domain posed a high risk while active.