soph[.]airdrpsalert[.]cfd

The domain soph.airdrpsalert.cfd is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service but is designed to deceive users into disclosing sensitive information through credential harvesting. No crypto drainer kit was observed. As of the latest verification, soph.airdrpsalert.cfd has been taken offline.

Technical indicators confirm the malicious nature of soph.airdrpsalert.cfd. The domain was flagged by 14 of 95 security vendors on VirusTotal, including ChainPatrol, BitDefender, and CRDF. It appears on one security blocklist, PhishDestroy, and was registered through Dynadot LLC on October 22, 2025. The domain resolves to the IP address 142.250.80.68, hosted on Google LLC's infrastructure (AS15169) in the US. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0 out of 100.

Users who interacted with soph.airdrpsalert.cfd should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all sensitive accounts to prevent unauthorized access. Monitor financial and online accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google's abuse team via their reporting page and to anti-phishing organizations like the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org.