tia[.]airdropsalert[.]us

Analysis of the domain tia.airdropsalert.us, observed as offline as of July 23, 2026, shows a clear pattern of brand impersonation targeting Google. The domain was registered on October 18, 2025 through Dynadot LLC and resolves to the IP address 172.253.63.104, which belongs to AS15169 owned by Google LLC and is located in the United States. No TLS certificate is presented for the host, indicating that HTTPS is not offered. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, suggesting the use of a third‑party DNS service. The page title returned by the server is the literal string “Google”, matching the declared brand target and reinforcing the impersonation intent.

The site is classified as a crypto‑scam, although the exact payload or transaction flow has not been observed. Detection telemetry shows that twelve of ninety‑three security vendors on VirusTotal flagged the domain, providing independent corroboration of malicious intent. The domain appears on a single external blocklist and is specifically listed by PhishDestroy as blocked, confirming that at least one community‑maintained feed has taken action. Because the site is currently offline, active probing was not possible, and no additional content or HTTP response codes could be captured. Uncertainty remains regarding the precise scam mechanics, such as whether the site attempted to harvest credentials, solicit cryptocurrency payments, or employed redirect chains.

No SSL/TLS handshake, no content snapshot, and no further intelligence from open‑source feeds have been recorded. Defenders should continue to monitor the IP address 172.253.63.104 for any future services, enforce blocklist entries in perimeter defenses, and ensure that any traffic to tia.airdropsalert.us is denied at the DNS or firewall layer.