threshold[.]airdropsalert[.]biz

Analysis of the domain threshold.airdropsalert.biz indicates confirmed phishing infrastructure targeting Google's brand, classified as a crypto scam. Registered on October 18, 2025, through Dynadot LLC, the domain resolved to IP address 192.178.155.105, hosted under AS15169 (Google LLC) in the United States. The site's page title was explicitly 'Google,' aligning with the identified brand impersonation. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare as the DNS provider, though no SSL certificate was detected.

As of July 23, 2026, the domain appears offline, with no active HTTP response or live content available for further analysis. Security vendor detections on VirusTotal flagged the domain as malicious, with 14 of 95 engines identifying it as a threat. It is currently blocked by PhishDestroy and listed on one security blocklist, reinforcing its classification as phishing infrastructure. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious nature.

While the exact content and mechanics of the scam remain unconfirmed due to the site's offline status, the available evidence—including the page title, brand target, and scam type—strongly supports its use in a crypto-focused fraud campaign. Defenders should treat this domain as confirmed malicious infrastructure. Recommended actions include blocking resolutions to 192.178.155.105, monitoring for re-registration or DNS changes, and alerting users to potential brand impersonation risks associated with this domain. Given its offline status, continuous monitoring for reactivation or similar domains registered through the same registrar or hosting provider is advised.