sophon[.]airdrpsalert[.]bond

This domain, sophon.airdrpsalert.bond, is flagged as a brand impersonation threat targeting Google. Analysis indicates the site was designed to mimic Google’s official branding, as evidenced by the page title 'Google' and the domain’s infrastructure alignment with known phishing campaigns. The threat type is classified as brand impersonation, a tactic commonly used to deceive users into divulging credentials or sensitive information under the guise of a trusted entity. No drainer kit signatures were explicitly identified, but the domain’s behavior aligns with credential harvesting or phishing distribution patterns.

Technical indicators reveal multiple red flags. The domain was registered on October 26, 2025, through Dynadot LLC, a registrar frequently associated with newly created malicious domains. It resolves to the IP address 142.250.181.228, which, while geographically plausible for Google infrastructure, is inconsistent with Google’s verified IP ranges for legitimate services. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, a low but notable signal given the domain’s recent creation. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, further corroborating its malicious classification. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s offline status suggests it may have been proactively blocked or taken down.

As of the latest assessment, sophon.airdrpsalert.bond is offline, likely due to takedown actions or registrar intervention. However, the elevated risk level persists due to the domain’s recent creation and association with brand impersonation tactics. Organizations and users are advised to treat any prior interactions with this domain as compromised and to monitor for related indicators of compromise (IoCs). Remaining risks include potential reuse of the infrastructure or registration of similar domains by the same threat actor. Proactive measures such as blocking the domain and IP at the network level, as well as educating users on recognizing brand impersonation tactics, are recommended to mitigate future threats.