threshold[.]hub-airdropalert[.]cfd

The domain threshold.hub-airdropalert.cfd was registered on November 09, 2025 and is presently taken offline. It is hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and resolves to IP address 142.250.65.228, an address owned by Google LLC (AS15169) in the United States. The lack of an SSL certificate combined with a page title that simply reads "Google" indicates a deliberate attempt to mimic the Google brand without providing encrypted communications. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the assessment that the site is malicious.

VirusTotal analysis shows that eight of ninety‑five scanning engines flagged the domain, suggesting a consensus of malicious behavior among security vendors. The domain is listed on one security blocklist and has been explicitly blocked by PhishDestroy, confirming that it has been recognized by threat‑intelligence feeds. Registration was performed through Dynadot LLC, a registrar frequently used by threat actors for rapid domain acquisition.

The threat profile identifies the site as a crypto‑related scam that impersonates Google, aligning with the brand‑impersonation classification. Defenders should immediately add threshold.hub-airdropalert.cfd to DNS and proxy blocklists, enforce HTTPS‑only policies to prevent accidental connections, and monitor the associated IP for any future re‑use. Continuous observation of the Cloudflare name servers for any re‑activation of the domain is advised, as well as periodic re‑scanning with multi‑engine services to capture any changes in detection status.