dashboard-sophon[.]xyz

This domain, dashboard-sophon.xyz, was registered on April 14, 2026, through Dynadot LLC and is currently active as of July 12, 2026. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3, located in Canada and associated with CloudFlare, Inc. The domain uses CloudFlare nameservers (marvin.ns.cloudflare.com and veda.ns.cloudflare.com) and presents an HTTP 403 status with the page title 'Just a moment...', a response commonly associated with CloudFlare protection or interstitial pages. No specific brand, scam type, or phishing kit has been confirmed in available data, though the domain is classified as generic phishing. Security vendors have flagged dashboard-sophon.xyz on three blocklists, including PhishDestroy, MetaMask, and SEAL. Six of 94 security vendors on VirusTotal detect the domain as malicious. The domain also appears in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let's Encrypt (serial number E8), which is consistent with both legitimate and malicious infrastructure. Defenders should treat this domain as high-risk due to its active status, CloudFlare-hosted infrastructure, and detection by multiple security sources. While the exact content or target of the phishing operation remains unconfirmed, the domain's presence on blocklists and its association with known phishing indicators warrant immediate blocking at the DNS or network level. Further analysis of related infrastructure or historical WHOIS data may provide additional context, though no direct links to other campaigns are currently documented.