sophon[.]airdropsalert[.]app

On 23 July 2026, the domain sophon.airdropsalert.app was observed hosting a Google‑branded page that is classified as a crypto‑scam impersonating the Google brand. The site resolves to the IPv4 address 216.58.206.36, which belongs to AS15169 operated by Google LLC and is geo‑located in Germany. Registration information indicates the domain was provisioned through Cloudflare, Inc., but the authoritative nameservers could not be retrieved (NS_NOT_FOUND). No TLS certificate is presented, leaving the site accessible only via HTTP.

VirusTotal reports that 16 of 95 security engines flagged the domain, and it appears on a single external blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The page title returned by the server is “Google”, matching the declared brand target. The overall risk rating is elevated, and the campaign status is recorded as offline, suggesting the malicious infrastructure has been taken down or is no longer serving content.

While the presence of a Google‑owned IP could be an attempt to lend credibility, the lack of SSL, the low trust score, and the positive detections collectively support the conclusion that the domain was used for fraudulent cryptocurrency solicitation. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑use of the underlying IP address, and consider adding the domain to internal blocklists. Ongoing observation of Cloudflare‑registered domains that resolve to Google IP ranges is advisable, as threat actors may exploit similar infrastructure in future campaigns.