sophon[.]airdrpsalert[.]life

The domain sophon.airdrpsalert.life was observed hosting a brand‑impersonation campaign targeting Google. The site resolved to IP address 142.251.16.105, which belongs to AS15169, Google LLC, and is geolocated in the United States. No TLS certificate was presented, indicating that the service was delivered over plain HTTP. The page title returned by the server was "Google," matching the declared brand target.

Infrastructure analysis shows the domain was registered via Cloudflare, Inc., and the nameserver information could not be retrieved (NS_NOT_FOUND). The domain has been taken offline and is currently blocked by the PhishDestroy sinkhole, but it remains listed on at least one external security blocklist. VirusTotal scans recorded 12 detections out of 95 participating vendors, confirming that multiple commercial engines flagged the host as malicious. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

The lack of an SSL certificate, combined with the low trust score and multiple vendor detections, suggests a deliberate attempt to lure victims to a non‑secure replica of a Google login portal. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP address or Cloudflare‑associated registrant, and update internal threat intel feeds with the observed indicators. Because the site is offline, no further payload or credential‑harvesting behavior can be confirmed, and analysts should treat any future re‑activation as a high‑confidence indicator of renewed brand‑impersonation activity.