sophon[.]airdropalerts[.]icu

Analysis of sophon.airdropalerts.icu shows a domain created on October 14, 2025 that is currently offline but was previously used to impersonate Google in a fake‑airdrop scheme. The page title collected from the site was "Google," confirming direct brand targeting. VirusTotal scans recorded 12 positive detections out of 95 security vendors, indicating that multiple AV engines identified malicious behavior. The domain resolves to IP address 142.250.186.164, which is registered to AS15169 Google LLC in the United States, suggesting the attacker leveraged legitimate Google infrastructure or a compromised host to increase credibility.

No SSL certificate is presented, so any communication would occur over unencrypted HTTP, exposing users to credential harvesting and session hijacking. Gridinsoft assigned a trust score of 0 / 100, and the site appears on a single external blocklist, while PhishDestroy has already blocked it. Registration was processed through Dynadot LLC, and the domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common configuration for fast‑flipping phishing infrastructure.

Uncertainty remains regarding the exact payload delivered, the extent of user interaction, and whether the IP address is shared with legitimate Google services or is a temporarily hijacked node. Defenders should continue to deny resolution of sophon.airdropalerts.icu at the DNS level, add the domain to internal URL filtering and reputation lists, monitor the associated IP for any resurgence of malicious activity, and watch for re‑registration attempts. Given the low trust score and multiple vendor detections, immediate inclusion in blocklists is warranted, and security teams should alert users about the fake Google airdrop lure to reduce the risk of credential compromise.