sui[.]airdropsalert[.]live

The domain sui.airdropsalert.live was identified as a brand‑impersonation site targeting Gmail users with a fake airdrop narrative. Analysis indicates the site was taken offline after being blocked by the PhishDestroy network. While offline, the domain resolved to the IPv6 address 2607:f8b0:4004:c19::69, an address owned by AS15169 Google LLC, suggesting the threat actor leveraged legitimate Google infrastructure to improve perceived trustworthiness. No SSL certificate was observed, meaning the site served only over HTTP, which is inconsistent with the security expectations of the impersonated brand. The page title returned "Google," reinforcing the attempt to masquerade as a Google service.

VirusTotal scans recorded 12 detections out of 95 security vendors, providing independent confirmation of malicious intent. Registration data shows the domain was provisioned through Cloudflare, Inc., a common service used by both legitimate sites and threat actors for anonymized hosting. HTTP response code 200 was returned, indicating the server delivered content when accessed prior to takedown. Nameserver information was not disclosed (NS_NOT_FOUND), limiting deeper DNS attribution.

The domain appears on a single security blocklist, and its removal from active use reduces immediate exposure, but the underlying infrastructure—Google‑owned IP space and Cloudflare registration—remains reusable for future campaigns. Defenders should continue to monitor for re‑registration of the domain or its sub‑domains, enforce strict URL filtering for any reference to "airdropsalert.live," and ensure email security controls flag any unsolicited airdrop communications that reference Gmail. Network defenders should also consider adding the IPv6 address to blocklists, despite its legitimate ownership, to mitigate collateral abuse. Ongoing intelligence sharing with threat‑intel platforms is recommended to track any resurgence of the same campaign infrastructure.