sophon-agents-app[.]pages[.]dev

Analysis of sophon-agents-app.pages.dev, created on February 26, 2026, indicates that the domain is being used for a brand‑impersonation campaign targeting Gmail users. The site resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States, and is protected by a Let’s Encrypt/E8 TLS certificate that enforces HSTS and serves content over HTTP/3. The domain is hosted on Cloudflare’s infrastructure, as reflected by the registrar information and the nameserver set {adi.ns.cloudflare.com, coco.ns.cloudflare.com, dante.ns.cloudflare.com, karl.ns.clo}.

An HTTP request returns a 403 status code, and the page title reported by scanners is "Sophon Agents". Security‑vendor scans on VirusTotal show that 2 of 93 engines flagged the domain, while Gridinsoft assigns a trust score of 0 / 100. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

Current operational status is offline, but the infrastructure remains allocated and could be re‑activated. Defenders should continue to block the domain at the DNS and proxy layers, add the IP address 188.114.96.3 to threat‑intel feeds, and monitor Cloudflare‑associated subdomains for similar patterns. Because the content of the page has not been publicly disclosed, the exact phishing payload remains unknown; however, the combination of brand impersonation, low trust score, and vendor detections warrants elevated risk classification and proactive mitigation.