sophon[.]app-airdropalert[.]lat

Analysis of sophon.app-airdropalert.lat shows a domain created on November 10, 2025 and registered through Dynadot LLC. The domain resolves to IP address 142.250.185.68, which belongs to AS15169 Google LLC and is geo‑located in the United States. Despite the legitimate‑looking IP, the site presents no SSL certificate, leaving the HTTPS handshake insecure. The page title returned by the web server is "Google," and the known intelligence tags the domain as impersonating Google for a crypto‑related scam. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy.

Independent scanning on VirusTotal recorded detections by 13 of 95 security vendors, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com point to Cloudflare, a common choice for fast deployment of malicious infrastructure. The current status is offline, suggesting that the operators have withdrawn the site after detection.

However, the infrastructure—registration details, Cloudflare DNS, and the use of a Google‑owned IP range—could be reused for future campaigns. Defenders should continue to monitor the domain and its associated IP, enforce blocklist entries, and consider adding the domain to internal deny lists. Given the lack of SSL and the presence of multiple vendor detections, any traffic to the domain should be treated as malicious. Future investigations should verify whether the IP address is being abused by other unrelated domains and confirm if the Cloudflare nameservers are being leveraged for additional phishing or crypto‑draining sites.