alt[.]airdropalerts[.]pro

Analysis of alt.airdropalerts.pro shows a brand‑impersonation operation that targets Google users with a crypto‑scam theme. The domain was registered on November 27, 2025 through Dynadot LLC and uses Cloudflare nameservers (alexa.ns.cloudflare.com, randall.ns.cloudflare.com). It resolves to IP address 142.250.185.164, which belongs to AS15169 owned by Google LLC in the United States. No SSL certificate is presented, and the HTTP response currently reports the page title "Google," matching the declared brand target.

Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of malicious intent. VirusTotal reports that 11 of 93 security vendors have flagged the domain, and it appears on at least one public blocklist, specifically PhishDestroy. The site is listed as a crypto scam and its status is recorded as taken offline, limiting immediate observation of payloads or redirects. Defenders should treat the domain as hostile: block the hostname and its resolved IP at perimeter firewalls and DNS filtering points, and add the associated IP range to any threat‑intel feeds that monitor Google‑owned address space for abuse.

Continuous monitoring of the registrar Dynadot for new domains using similar sub‑domain patterns (e.g., airdropalerts) is recommended, as well as periodic re‑scanning of the IP address for any resurgence of activity. Because the site currently returns no TLS certificate, any attempt to serve content over HTTPS would be anomalous and should be logged. The combination of a zero trust score, multiple vendor detections, and explicit blocklist inclusion underscores the elevated risk posed by this domain, and immediate defensive actions are advised.