eth[.]app-airdropalert[.]sbs

The domain eth.app-airdropalert.sbs was registered on November 10, 2025 through Dynadot LLC and is hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. It resolves to IP address 216.58.206.36, an address allocated to AS15169 Google LLC and geolocated in Germany. No SSL certificate is presented for the site, indicating that traffic is not protected by HTTPS. The page title returned by the server is "Google", matching the declared brand target and confirming a brand‑impersonation intent. The hosting infrastructure appears deliberately chosen to mirror legitimate Google services, a common tactic in crypto‑scam campaigns that aim to deceive victims by exploiting brand trust.

Detection metrics show that 15 of 95 security vendors on VirusTotal flagged the domain as malicious, and it is listed on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The domain was actively blocked by the PhishDestroy sinkhole and is currently taken offline, as indicated by the status field. Although the site is no longer reachable, the infrastructure artifacts remain observable and may be reused in future campaigns.

Defenders should continue to enforce network‑level blocks for eth.app-airdropalert.sbs and monitor for any resurgence of the same IP address or similar sub‑domain patterns that reference Google. Given the use of a Google‑owned IP range, threat‑hunters should treat any anomalous traffic to 216.58.206.36 from unexpected client contexts as potentially suspicious, especially if coupled with crypto‑related payloads. Ongoing vigilance is recommended for other domains registered through Dynadot that resolve to Cloudflare name servers and lack TLS, as these characteristics have recurred in the observed campaign.