play-sopho[.]pages[.]dev

Analysis of play-sopho.pages.dev indicates that the domain is actively leveraged for a generic phishing campaign. The site was registered on March 10, 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.47.93 within AS13335, a Cloudflare‑owned autonomous system located in the United States. The domain uses Cloudflare‑issued TLS certificates (Google Trust Services / WE1) and supports HTTP/3, HSTS, and a collection of front‑end libraries including Unpkg, jsDelivr, SweetAlert2, crypto‑js, and cdnjs. The page title returned by the server is "Sophon" and the HTTP response code is 403, suggesting that the content is currently inaccessible, which aligns with the reported offline status.

Reputation data shows the domain appears on four independent security blocklists and has been flagged by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence. VirusTotal analysis reports three detections out of ninety‑four scanning engines, confirming malicious intent despite the low detection count. The registrar listed is Cloudflare, Inc., and the authoritative name servers are jack.ns.cloudflare.com and lina.ns.cloudflare.com.

While the exact phishing payload and targeted brand are not disclosed in the available intelligence, the convergence of low trust scoring, multiple blocklist listings, and vendor detections provides sufficient evidence for classification as a confirmed phishing site. Defenders should block the domain at network perimeter devices, update URL filtering policies, and monitor for any related sub‑domains or similar Cloudflare‑hosted assets that exhibit comparable technology stacks. Ongoing threat‑intel feeds should be consulted for any future re‑activation, and incident response teams should treat any traffic to the domain as malicious until a formal takedown is confirmed.