wlfi[.]airdropalerts[.]bond

wlfi.airdropalerts.bond is a newly registered domain (created 14 Oct 2025) that has been used in a fake airdrop campaign targeting users of Google services. The site resolves to 142.250.80.100, an address owned by AS15169 Google LLC, which suggests the attacker leveraged legitimate Google infrastructure to host the malicious page. No TLS certificate is presented, meaning the site was served over plain HTTP. The page title returned by the server is simply “Google”, matching the declared brand target and confirming the intent to impersonate Google.

The domain is registered through Dynadot LLC and uses Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, and it appears on one public security blocklist. PhishDestroy has already taken the site offline, and the current status is listed as offline. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Defenders should add wlfi.airdropalerts.bond to URL filtering and DNS block lists, monitor for any re‑registration attempts, and consider raising alerts for any outbound connections to the associated IP address. Ongoing observation of the hosting ASN and registrar may reveal further infrastructure reuse. Because the site is no longer active, immediate mitigation focuses on preventing future reuse of the same domain or IP range.