soph[.]stakingreward[.]dev

Analysis of soph.stakingreward.dev indicates a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on December 27 2025 and is currently taken offline. DNS resolution points to IP 142.250.193.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The authoritative nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, both Cloudflare‑managed.

No TLS certificate is presented, meaning the site served only over HTTP, which reduces confidentiality but does not mitigate the impersonation risk. The page title returned by the server is “Google,” matching the claimed brand target. A Gridinsoft trust score of 0 / 100 reflects a malicious assessment, and the domain appears on a single security blocklist, specifically flagged by PhishDestroy. VirusTotal scans report that 15 of 93 security vendors classify the domain as malicious, reinforcing the suspicion.

The scam type is recorded as brand impersonation, yet the actual page content has not been captured because the site is offline, leaving the specific phishing vector unknown. Defenders should immediately block the domain at network perimeters, add it to endpoint denial lists, and monitor for any re‑registration or similar domains that resolve to Google‑owned IP ranges. Continuous sharing of this indicator with threat‑intel platforms is recommended to improve collective detection of Google‑focused impersonation attempts.