sophon[.]airdrpalerts[.]sbs

The domain sophon.airdrpalerts.sbs is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing login credentials or other sensitive information. No crypto drainer kit was detected. The site is currently taken offline, but it remains a documented threat for historical reference and potential re-emergence.

Technical indicators confirm the domain's malicious intent. sophon.airdrpalerts.sbs was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, SOCRadar, and Webroot. It appears on 1 security blocklist (PhishDestroy) and was registered through Dynadot LLC on October 25, 2025. The domain resolves to the IP address 142.250.81.228, hosted on Google LLC's infrastructure (AS15169), and uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). No SSL certificate was issued, and the observed page title was 'Google'. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a phishing domain.

Users who interacted with sophon.airdrpalerts.sbs should immediately change any credentials entered on the site, particularly Google account passwords. Enable two-factor authentication (2FA) on all accounts to mitigate further risk. Monitor financial and email accounts for unauthorized activity. Report the domain to Google's Safe Browsing team via their reporting tool and to anti-phishing organizations such as PhishTank or the Anti-Phishing Working Group (APWG). If the domain reappears, avoid visiting it and notify security providers to update blocklists.