mon[.]airdropalerts[.]bond

This domain, mon.airdropalerts.bond, was registered on 14 October 2025 through Dynadot LLC. The site is currently taken offline, but archival data shows the page title was simply “Google”, indicating an attempt to masquerade as a legitimate Google‑related service. The listed scam type is a “Fake Airdrop”, a common social engineering lure that promises cryptocurrency distributions in exchange for personal information. The domain resolves to IP address 142.250.185.196, which belongs to ASN 15169 and is listed as part of Google LLC’s network in the United States. Although the IP belongs to a reputable provider, the absence of an SSL certificate suggests the site was not using HTTPS, a typical indicator of low‑cost or temporary malicious infrastructure.

Nameserver records point to Cloudflare (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com), a service frequently leveraged for fast deployment and mitigation of takedown requests. Four of ninety‑five security scanners on VirusTotal flagged the domain, confirming that at least a minority of reputable detection engines consider it malicious. The domain appears on a public security blocklist and is explicitly blocked by PhishDestroy, indicating that defensive communities have observed malicious activity associated with it. No additional threat‑intel sources such as OTX or Google Safe Browsing entries were provided, leaving the broader detection footprint uncertain.

Defenders should continue to deny any network connections to mon.airdropalerts.bond and add the domain to URL filtering rules. Because the host IP is part of Google’s infrastructure, organizations may consider monitoring for other short‑lived subdomains that resolve to the same address. Users should be warned that unsolicited messages claiming a Google‑branded airdrop are likely fraudulent, and they should not provide credentials or cryptocurrency wallet details.