soph[.]airdropalerts[.]bond

This domain, soph.airdropalerts.bond, was registered on 14 October 2025 through Dynadot LLC and is currently listed as offline. DNS resolution points to IP address 142.250.185.100, which belongs to AS15169 Google LLC and resolves to a location in the United States. No SSL certificate is presented for the host, indicating that the site does not offer HTTPS protection. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both associated with Cloudflare's DNS infrastructure. The page title returned by the server is “Google”, matching the declared impersonation of the Google brand.

The domain is classified as a “Fake Airdrop” scam and is reported to impersonate Google, a technique commonly used to lure victims into providing credentials or personal information under the pretense of receiving an airdrop reward. Security telemetry shows that the domain appears on one blocklist and has been flagged by PhishDestroy. VirusTotal analysis reports that 11 of 95 scanning engines label the domain as malicious, reinforcing the suspicion of fraudulent activity. At present no HTTP response body or login form has been captured, so the exact content of the fraudulent page cannot be confirmed. The lack of an SSL certificate also hampers any attempt to analyze encrypted traffic.

While the site is offline, its infrastructure—particularly the use of Google‑owned IP space and Cloudflare DNS—can be leveraged by threat actors to increase perceived legitimacy. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the associated name servers, and add the IP address to reputation lists. Correlation with the domain name is essential because the IP is owned by Google and may generate false positives if used elsewhere. Additional investigation of any historical HTTP responses or payloads, if available, would help confirm the exact phishing tactics employed.