airsdropsalert[.]lol

airsdropsalert.lol was registered on 5 November 2025 through Dynadot LLC. The authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to 142.250.185.100, an address owned by AS15169 Google LLC located in the United States. The site presents the page title “Google”, matching the declared brand target and the listed scam type of brand impersonation. No TLS certificate was observed, indicating the site was served over plain HTTP. VirusTotal reports that 7 of 95 scanned security vendors flagged the domain, reinforcing the malicious classification.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on four external blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain is currently taken offline, and no active HTTP response could be retrieved at the time of analysis. The combination of a Google‑owned IP address, a fabricated brand‑related page title, the absence of encryption, and multiple vendor detections point to a deliberate attempt to exploit Google’s brand reputation.

Uncertainties remain regarding the specific phishing kit or payload because the site content has not been captured. Defenders should immediately add airsdropsalert.lol to firewall and DNS filtering rules, monitor for any resurgence of the domain or similarly named variants, and consider tightening e‑mail and web gateway policies for traffic to Google‑associated IP ranges that lack TLS. Continuous observation of the associated Cloudflare name servers is advised to detect potential re‑use of the infrastructure for future impersonation campaigns.