yield[.]airdropsalert[.]onl

This domain, yield.airdropsalert.onl, was observed hosting a crypto‑scam page that uses the brand name Google in its page title. The site was created on 18 October 2025 through the registrar Dynadot LLC and resolves to the IP address 142.250.176.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain does not present an SSL certificate and currently returns an offline HTTP status, indicating that the malicious content has been taken down or the server is no longer reachable. Infrastructure analysis shows that the domain is delegated to the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for fast‑flux or proxy‑based hosting used by threat actors.

Reputation services have flagged the domain. Gridinsoft assigns a trust score of 0 out of 100, effectively marking it as fully untrusted. The domain appears on a single security blocklist, where it is listed by PhishDestroy. VirusTotal scans report that 14 of 95 antivirus or URL‑reputation engines flagged the domain as malicious, reinforcing the suspicion of a crypto‑drain operation.

No TLS certificate was observed, and the lack of HTTPS further reduces the credibility of the site. The available intelligence confirms that the domain impersonates Google and is associated with a crypto‑scam, but the exact payload, phishing kit, or victim interaction flow has not been captured in the current data set. Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the observed IP address and name server pair, and monitor for any resurgence of activity from the same IP range or Cloudflare name servers. Because the domain is already offline, incident response teams can prioritize containment and consider the indicator as a high‑confidence indicator of compromise for any recent user reports involving Google‑themed crypto offers.