op[.]airdropsalert[.]xyz

op.airdropsalert.xyz is currently offline but historical analysis shows it was used for a brand‑impersonation campaign targeting Google users with a crypto‑scam lure. The domain was registered through Dynadot LLC on 17 October 2025 and employs the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served over plain HTTP. DNS resolution points to 142.250.186.132, an address announced by AS15169 Google LLC in the United States. Hosting the malicious payload on infrastructure owned by the legitimate brand adds credibility to the impersonation attempt and may evade superficial network filters.

VirusTotal scans recorded 14 detections out of 95 security vendors, and the domain appears on one external blocklist. PhishDestroy has already taken the domain offline, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The page title returned by the server is simply “Google”, matching the declared brand target. The campaign is classified as a crypto scam, though no further payload details are available in the current intelligence set. Defenders should add op.airdropsalert.xyz to network‑level deny lists and ensure that DNS resolvers block resolution to the listed IP address.

Email filters should be updated to flag any messages containing the domain or referencing Google‑related cryptocurrency offers. Monitoring for new domains registered with the same registrar, similar naming patterns, or using the same Cloudflare nameservers can help detect follow‑on activity. Because the domain leverages a legitimate Google IP range, endpoint security solutions should be configured to inspect HTTP traffic even when the destination resides in a trusted AS, and heuristic detection for brand‑impersonation should be enabled. Continuous review of threat‑intel feeds for additional indicators of compromise related to this seed (72a499) is recommended.