sophon[.]airdrpsalerts[.]sbs

Analysis as of July 23 2026 indicates that the domain sophon.airdrpsalerts.sbs was registered on October 29 2025 through Dynadot LLC. The site presented a page title of "Google" and is classified as a brand impersonation campaign targeting Google. The domain resolves to IP 142.250.186.68, which belongs to AS15169 owned by Google LLC and is geolocated in Germany. Despite the IP belonging to a legitimate Google infrastructure, the domain uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and does not present a valid SSL certificate, implying the site either served only HTTP or was taken offline before an HTTPS certificate could be provisioned. Security scanning on VirusTotal shows that 14 of 95 antivirus and URL scanners flagged the domain as malicious, and the domain appears on one external blocklist.

Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. PhishDestroy has already blocked the domain, and the current online status is offline. Uncertainty remains around the specific phishing payload or credential‑stealing page because no visual analysis or content capture is available. The absence of a TLS certificate and the offline status limit real‑time verification, but the combination of brand‑impersonation metadata, low trust score, and multiple vendor detections strongly points to a phishing operation.

Defenders should add sophon.airdrpsalerts.sbs to internal blocklists for both DNS and HTTP filtering, monitor for any future re‑registration of the domain or similar sub‑domains, and consider extending detection rules to cover the associated IP range (142.250.186.0/24) only after confirming legitimate traffic. Email security gateways should enforce brand‑specific policies for Google‑related communications, and any inbound traffic to this domain should be quarantined or discarded.