soph[.]app-airdropalert[.]lat

Analysis of soph.app-airdropalert.lat indicates an elevated‑risk brand‑impersonation campaign targeting Google users. The domain was registered on November 10, 2025 through Dynadot LLC and resolves to IP address 142.250.185.68, which belongs to AS15169 Google LLC located in the United States. Despite the IP being owned by Google, the domain is unauthenticated; no SSL certificate is presented, and the site returns an HTTP response that has been taken offline as of the reporting date, July 23, 2026. The page title returned by the server is "Google", matching the declared brand target.

The infrastructure utilizes Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common choice for fast‑flux or proxy services. Security telemetry shows the domain appears on a single blocklist and received a Gridinsoft trust score of 0 out of 100, indicating a lack of reputation. VirusTotal scans report that 13 of 95 antivirus and URL‑reputation engines flagged the domain, confirming malicious activity. PhishDestroy has already blocked the domain, and it is listed as offline, reducing immediate exposure but not eliminating the risk of re‑use or replication.

The campaign is classified as a crypto scam, suggesting that victims may have been lured into sending cryptocurrency under the pretense of a Google‑related airdrop. Defenders should add soph.app-airdropalert.lat to URL filtering and DNS blocklists, monitor for any resurrection of the domain or similar patterns using the same registrar, nameservers, or IP range, and consider extending monitoring to other domains that resolve to Google‑owned IP blocks but lack TLS. Continuous threat‑intel feeds should be consulted for new detections, and incident response teams should be prepared to handle potential crypto‑drain attempts that reference Google branding.