flow[.]airsdropsalert[.]lol

The domain flow.airsdropsalert.lol was registered through Dynadot LLC and first seen on 5 November 2025. DNS resolution points to 142.250.184.196, an address owned by Google LLC (ASN 15169) located in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No TLS certificate is presented for the host, meaning the site is served only over plain HTTP. The HTTP response contains a page title of “Google”, which aligns with the reported brand‑impersonation target of Google.

The domain has been classified as a brand‑impersonation scam and is currently taken offline. Detection data show that one of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external security blocklist. PhishDestroy has already blocked the host, and the Gridinsoft trust score is 0 out of 100, reflecting a highly malicious rating. The combination of a Google‑owned IP address, a misleading page title, and the absence of encryption suggests an attempt to exploit the trust associated with the Google brand.

At present, the precise content that was served before the takedown is unknown, and no additional indicators such as malicious payloads or credential‑harvesting forms have been disclosed. Defensive teams should continue to enforce the existing block on flow.airsdropsalert.lol across DNS filtering, proxy, and endpoint controls, and they should monitor the associated IP address for any future reuse. Adding the domain to internal blocklists and sharing the indicator with threat‑intel feeds will help prevent accidental exposure. Ongoing observation of the Cloudflare name‑server pair may reveal if the infrastructure is repurposed for other impersonation campaigns.