wct[.]airdropsalert[.]us

Analysis of the domain wct.airdropsalert.us shows that it was registered on October 18, 2025 through Dynadot LLC and uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). The site resolves to IP address 172.253.63.99, an address owned by AS15169 Google LLC and geolocated in the United States. Despite the legitimate‑looking hosting, the domain lacks an SSL certificate and currently returns no HTTP response because it has been taken offline. The page title returned when the site was reachable was "Google", matching the declared brand target of Google and indicating a clear brand‑impersonation intent. The listed scam type is a crypto scam, suggesting that the operator intended to lure victims into fraudulent cryptocurrency transactions.

Detection telemetry shows that fifteen of ninety‑three VirusTotal scanners flagged the domain, reflecting a modest but notable level of malicious classification across multiple security vendors. The domain also appears on one external blocklist and has been actively blocked by the PhishDestroy mitigation service. No Safe Browsing, OTX, or additional blocklist entries were reported in the available intelligence.

Given the convergence of brand impersonation, a crypto‑focused lure, and multiple vendor detections, defenders should treat wct.airdropsalert.us as a high‑confidence malicious indicator. Network‑level filters should be updated to block traffic to the IP 172.253.63.99 when associated with this hostname, and DNS sinkholing can be employed to prevent resolution. Email security gateways should add the domain to deny lists, especially for messages purporting to originate from Google. Because the site is currently offline, ongoing monitoring is advised to detect any re‑activation, changes in certificate status, or shifts to alternative hosting infrastructure.