vvv[.]airdropalert[.]us

Analysis of vvv.airdropalert.us indicates this domain was a brand-impersonation scam targeting Google, specifically designed to facilitate a cryptocurrency fraud scheme. The domain, registered on October 19, 2025, through Dynadot LLC, resolved to the IP address 142.251.40.164, which is geolocated in the United States and associated with AS15169 (Google LLC). While the hosting infrastructure aligns with Google’s network, this does not confirm legitimacy, as threat actors may exploit legitimate cloud services for malicious purposes. The domain’s nameservers—brenna.ns.cloudflare.com and hassan.ns.cloudflare.com—suggest Cloudflare was used for DNS management, a common tactic to obscure hosting origins and enhance resilience against takedowns.

The page title, recorded as 'Google,' directly aligns with the impersonated brand, reinforcing the domain’s role in a brand-impersonation campaign. No SSL certificate was detected, a red flag for user security, as modern browsers flag non-HTTPS sites as insecure. The domain was flagged by 13 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist, specifically PhishDestroy, which classified it as malicious. As of July 23, 2026, the domain is offline, though prior activity and detection metrics confirm its use in fraudulent operations.

Defenders should treat this domain as a confirmed threat. The absence of an SSL certificate, combined with its presence on security blocklists and detection by multiple vendors, provides concrete evidence of malicious intent. While the exact content of the site remains unanalyzed, the available data—including the page title, brand target, and scam classification—supports its identification as a crypto scam. Organizations should ensure this domain is blocked at the network level and monitor for related infrastructure, such as similar domains registered through Dynadot or using Cloudflare nameservers, which may indicate ongoing or evolving campaigns.