send[.]airsdropsalert[.]lol

The domain send.airsdropsalert.lol was registered on November 5, 2025 through Dynadot LLC and is currently listed as offline. Analysis shows that the site presented a page title of "Google," indicating a direct attempt to impersonate the Google brand. The domain resolves to IP address 142.250.65.228, which belongs to AS15169 Google LLC and is geolocated in the United States. Nameservers listed for the domain are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure.

No SSL/TLS certificate was observed, meaning the site lacks encrypted transport and would be served over plain HTTP if active. The domain appears on a single security blocklist, blocked by PhishDestroy, and received 8 detections out of 95 security vendors on VirusTotal, reflecting a moderate consensus among scanning engines that the domain is malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The identified scam type is brand impersonation targeting Google users.

While the exact content of the landing page has not been captured, the available evidence—page title, brand targeting, blocklist inclusion, and low trust score—supports the conclusion that the infrastructure was intended for credential harvesting or similar abusive activity. Uncertainty remains regarding any current hosting configuration or whether the domain may be re‑activated under a different IP address. Defenders should add send.airsdropsalert.lol to blocklists, monitor DNS queries for the domain and its associated nameservers, and consider proactive filtering of HTTP traffic to the IP 142.250.65.228. Continuous observation of VirusTotal and other threat‑intel feeds for re‑emergence is recommended.