sophon[.]airdrpsalerts[.]lol

Analysis of the domain sophon.airdrpsalerts.lol indicates a brand impersonation threat targeting Google. The domain was registered on October 29, 2025, through Dynadot LLC and resolves to the IP address 142.250.185.132, which is associated with AS15169 (Google LLC) in the United States. Despite the hosting IP belonging to Google, the domain itself exhibits multiple indicators of malicious activity. It currently appears on one security blocklist and is flagged by 8 of 95 security vendors on VirusTotal, though no SSL certificate is present.

The page title is explicitly labeled 'Google,' reinforcing the likelihood of brand impersonation. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. The domain was taken offline following its identification, though its prior operational status and exact content remain unconfirmed. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious.

Defenders should treat this domain as a confirmed phishing resource and ensure it is blocked at the DNS and proxy levels. Historical logs should be reviewed for connections to 142.250.185.132 or the domain itself, particularly in contexts involving Google services or user authentication flows. No evidence of a phishing kit or specific scam subtype (e.g., credential harvesting, malware distribution) is available at this time.