dolomite[.]airdropalert[.]us

On July 24, 2026 analysts observed that the domain dolomite.airdropalert.us is hosted without TLS and returns no SSL certificate. The domain was registered on October 19, 2025 through Dynadot LLC and is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP 192.178.155.105, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the legitimate‑looking IP ownership, the site is flagged by Google Safe Browsing for social engineering, appears on a security blocklist, and is listed by PhishDestroy. The page title reported by crawlers is "Google", matching the declared impersonation of the Google brand.

Gridinsoft assigned a trust score of 0 out of 100, indicating extreme suspicion. VirusTotal scans recorded detections from 11 of 93 security vendors, reinforcing the malicious classification. The site is identified as a crypto‑scam, though the exact payload or campaign details have not been released. The domain’s current HTTP status is offline, but historical evidence indicates that it was active long enough to be harvested by multiple detection services.

Uncertainty remains regarding the specific phishing kit or infrastructure used beyond the Cloudflare front‑end and the Google‑owned IP address. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation, and add the IP address to suspicious‑host lists. Because the domain leverages a reputable IP range, security teams should verify that the IP is not being abused elsewhere and consider tightening egress controls for traffic destined to AS15169. Ongoing observation of the associated nameservers and registrar may reveal future campaigns that reuse the same registration patterns.