threshold[.]airdropalerts[.]bond

Analysis of the domain threshold.airdropalerts.bond confirms its classification as a fraudulent site impersonating Google to conduct a fake airdrop scam. The domain was registered on October 14, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals the domain resolves to the IP address 142.251.179.106, which is geolocated in the United States and associated with AS15169 (Google LLC). However, this IP resolution does not indicate legitimate affiliation with Google, as the domain itself is hosted on Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). The site’s page title, 'Google,' directly aligns with the identified brand target, confirming its intent to deceive users into believing they are interacting with an official Google service.

The scam type is explicitly categorized as a fake airdrop, a tactic often employed to lure victims into disclosing sensitive information or transferring assets under false pretenses. No SSL certificate was detected, further reducing the domain’s legitimacy and increasing the risk of unencrypted data transmission. Detection data indicates the domain appears on at least one security blocklist, specifically PhishDestroy. Additionally, two out of 95 security vendors on VirusTotal flagged the domain as malicious.

The Gridinsoft trust score for this domain is 0/100, reinforcing its high-risk classification. While the domain is currently offline, defenders should treat any reactivation as a potential threat. Organizations are advised to block the domain at the DNS level, monitor for related infrastructure (e.g., IP, nameservers), and alert users to the risks associated with fake airdrop schemes targeting Google’s brand. Further investigation into the registrar (Dynadot LLC) and hosting provider (Cloudflare) may reveal additional linked domains or patterns in the campaign.