aethir[.]airdropsalert[.]us

The domain aethir.airdropsalert.us was registered on October 18, 2025 through Dynadot LLC and resolves to the IP address 172.253.63.99, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The site presented a page title of "Google" and is classified as a crypto‑scam that impersonates Google, indicating a brand‑impersonation attempt aimed at extracting cryptocurrency or related assets. No TLS certificate was observed, leaving the HTTP service unencrypted.

The domain was flagged by Google Safe Browsing for social engineering, and twelve of ninety‑three VirusTotal scanners raised detections, confirming malicious intent. It was added to the PhishDestroy blocklist and appears on one additional security blocklist, while the Gridinsoft trust score registered at 0 out of 100, reflecting extreme low trust. Nameserver delegation points to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for abused Cloudflare infrastructure.

The site is currently taken offline, but the historical evidence suggests that the infrastructure was deliberately leveraged to host a brand‑spoofing page that could have been used to lure victims into sending cryptocurrency. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and correlate any inbound traffic to the associated IP range with other known Google‑related abuse. Threat intelligence feeds should be updated to retain the domain’s indicator status, and incident response teams should be alerted to the possibility of credential harvesting or crypto‑drain attempts tied to the Google brand.