spaceandtime[.]airsdropsalert[.]lol

The domain spaceandtime.airsdropsalert.lol is currently offline and has been taken down by the PhishDestroy takedown service. Registration data shows the domain was created on 5 November 2025 through Dynadot LLC, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points to IP address 142.250.74.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No SSL certificate is presented for the host, meaning HTTPS connections would be unencrypted if the site were reachable.

The page title returned from the site, when it was online, was simply "Google," matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign. Reputation services show a Gridinsoft trust score of 0 out of 100, and the domain appears on one external security blocklist, reinforcing its malicious intent. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, providing additional corroboration of suspicious activity. The limited detection footprint suggests the site was short‑lived, likely intended for a narrow phishing window.

Uncertainty remains regarding the specific phishing kit or payload used, as no further content analysis is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host header or similar sub‑domains, and verify that internal users are aware of the impersonation attempt targeting Google credentials. Incident response teams should also update threat‑intel feeds with the observed indicators of compromise, including the domain name, registration details, IP address, and the two VirusTotal detections, to aid in rapid correlation of future attempts.