soph[.]asia

This domain, soph.asia, is registered through Web Commerce Communications Limited and was created on 13 June 2025. The authoritative name servers ns1.tohosting.com and ns2.tohosting.com resolve the domain to the IPv4 address 37.120.144.154, which is announced by AS9009 M247 Europe SRL and geolocated to Hungary. No TLS certificate is present, meaning the site would be served only over HTTP, which further reduces trust. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity.

VirusTotal reports that 2 of 95 security engines flag the domain, confirming that at least a small subset of scanners have identified it as malicious. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, reinforcing the assessment that it is being used for abusive purposes. The recorded scam type is brand impersonation targeting Google, and the intelligence explicitly lists the domain as impersonating the Google brand. The page title returned is empty, and no SSL certificate or additional page metadata have been observed, leaving the exact payload or landing page content unknown.

Because the site is currently offline, active probing is limited, but the infrastructure components—Hungarian hosting, low‑trust score, and inclusion on blocklists—are consistent with a typical brand‑impersonation campaign. Defenders should continue to deny DNS resolution for soph.asia, add the IP address 37.120.144.154 to network‑level deny lists, and monitor for re‑registration or similar domains that resolve to the same hosting provider. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any new detections should the domain be re‑activated. Organizations should also educate users about unsolicited communications that claim to originate from Google, as the domain’s sole declared objective is to masquerade as that brand.