sophon[.]airdrpsalerts[.]info

Analysis of the domain sophon.airdrpsalerts.info, assessed on July 23, 2026, confirms its classification as a brand-impersonation phishing site targeting Google. The domain was flagged by 13 of 95 security vendors on VirusTotal, indicating elevated detection coverage. Infrastructure analysis reveals the domain resolved to the IP address 142.250.176.196, which is geolocated in the United States and associated with AS15169 (Google LLC). However, the hosting context is anomalous, as the domain itself is not linked to Google's legitimate infrastructure. The domain was registered through Cloudflare, Inc., a registrar frequently utilized for both legitimate and malicious purposes.

No SSL certificate was present, and the domain's nameservers were reported as NS_NOT_FOUND, suggesting either misconfiguration or deliberate evasion techniques. The page title, 'Google,' directly aligns with the identified scam type of brand impersonation, reinforcing the intent to deceive users into believing the site is an official Google service. The domain appears on one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

As of the report date, the domain has been taken offline, though defenders should remain vigilant for potential resurfacing under similar or altered infrastructure. The absence of an SSL certificate and nameserver data may indicate a short-lived campaign designed for rapid deployment and takedown. Defenders are advised to monitor for related domains registered through Cloudflare or resolving to the same IP range, particularly those impersonating Google or other high-value brands. Additional scrutiny should be applied to domains with missing or misconfigured nameservers, as this trait is consistent with phishing infrastructure.