metis[.]airdropsalert[.]lol

On 24 July 2026, the domain metis.airdropsalert.lol was observed as part of a brand‑impersonation campaign targeting Google users with a fake airdrop lure. The domain was registered on 18 October 2025 through Dynadot LLC and is currently hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the IP address 142.250.181.228, which belongs to AS15169 Google LLC and is geolocated in the United States. The use of a Google‑owned IP range may be intended to increase credibility, but the server presents no TLS certificate, leaving the site accessible only over plain HTTP. The page title returned by the web server is simply “Google”, matching the declared brand target.

The site is classified as a “Fake Airdrop” scam and is listed as offline at the time of analysis. Detection data show that eleven of ninety‑five security vendors on VirusTotal flagged the domain, indicating a moderate level of consensus on malicious behavior. The domain is also listed on one external blocklist and has been actively blocked by the PhishDestroy mitigation service. No additional public threat‑intel feeds (e.g., OTX, Safe Browsing) are referenced in the available data. Evidence confirms that the infrastructure leverages legitimate Google‑owned IP space while lacking encryption, a pattern frequently observed in impersonation attempts that aim to evade automated detection.

Uncertainty remains regarding the full payload or landing page content, as no screenshot or content analysis is provided. Defenders should add the fully qualified domain name to URL filtering policies, enforce TLS inspection to detect the absence of a certificate, and consider network‑level blocking of the associated IP range for traffic that does not originate from known Google services. Continuous monitoring of the domain’s registration and DNS records is advised, as future re‑activation could be used to deliver the airdrop lure.