defiapp[.]airdropsalert[.]biz

The domain defiapp.airdropsalert.biz was registered on October 18, 2025 through Dynadot LLC and is currently taken offline. Technical analysis shows the site presented a page title of "Google," indicating a direct attempt to impersonate the Google brand. No SSL certificate was observed, leaving the HTTP connection unencrypted and untrusted. The domain resolves to IP address 192.178.218.103, which is assigned to AS15169 owned by Google LLC and geolocated in the United States.

Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. Reputation services rate the site extremely poorly; Scamadviser assigned a trust score of 1 out of 100, and the domain appears on a single security blocklist. Google Safe Browsing flagged the site for social engineering, and the PhishDestroy blocklist has also listed it as malicious. VirusTotal scans report that 16 of 95 antivirus engines flagged the domain, reinforcing the malicious classification.

The recorded scam type is a crypto scam, though the specific payload or monetary mechanism has not been disclosed. While the site is offline, its prior activity suggests a brief window of operation aimed at harvesting credentials or cryptocurrency assets under the guise of a legitimate Google service. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicators, and monitor for any resurgence of the same infrastructure, especially the Cloudflare nameservers and the Google‑owned IP range. Because the site employed brand impersonation without TLS, any future re‑registration of the same name or similar patterns should be treated as high‑risk and subjected to immediate containment.