dolomite[.]airdropsalert[.]us

Analysis of dolomite.airdropsalert.us shows a high‑risk brand‑impersonation campaign targeting Google users. The domain was registered on October 18, 2025 through Dynadot LLC and resolves to IP address 142.251.40.164, which belongs to AS15169 Google LLC in the United States. Despite resolving to a Google‑owned address space, the site lacks an SSL certificate and returns an offline HTTP status, indicating that the malicious content has been taken down or is no longer serving traffic. The page title returned by the server is "Google," confirming the intent to masquerade as the legitimate brand.

Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com were observed, a common pattern for fast‑flux or evasive infrastructures. The domain is flagged by PhishDestroy, carries a Gridinsoft trust score of 0 / 100, and is listed on a security blocklist. Google Safe Browsing classifies the site as a social‑engineering threat. VirusTotal analysis shows that 11 of 93 security vendors have flagged the domain, reinforcing the malicious assessment.

The campaign is identified as a crypto‑scam, although the exact payload or lure is not available in the current data set. Defenders should add the domain and its associated IP to network blocklists, enforce domain‑based filtering for outbound traffic, and monitor for new registrations that reuse the same name‑server pair or target the same brand. Continuous observation of Dynadext’s registration activity and Cloudflare name‑server usage can help detect future replicas. Because the site is currently offline, immediate incident response is not required, but the infrastructure footprint suggests a reusable template that may reappear under a different domain; proactive brand‑monitoring and threat‑intel sharing are recommended.