arb[.]airdropalerts[.]pro

The domain arb.airdropalerts.pro was observed to host a crypto‑related impersonation campaign targeting Google users. Registration data shows the domain was created on 27 November 2025 through Dynadot LLC, and its WHOIS record lists the authoritative nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, indicating the use of Cloudflare DNS services. The domain resolves to IP address 142.250.185.164, which belongs to AS15169 owned by Google LLC and is located in the United States, a common tactic to lend credibility to spoofed sites. Static analysis on VirusTotal indicates that seven of ninety‑three antivirus and URL‑reputation engines flagged the domain as malicious, providing early corroboration of its malicious intent. The site appears on a single external blocklist and is specifically listed by PhishDestroy, reinforcing its classification as a phishing‑oriented resource.

Gridinsoft assigns a trust score of zero out of one hundred, further confirming the lack of legitimacy. The HTTP service was reported as offline at the time of assessment, and no TLS certificate was presented, meaning the site operated over plain HTTP only. The page title returned by the server is “Google”, matching the declared brand target and aligning with the impersonation claim. No additional content, such as login forms or redirect behavior, has been captured, so the exact user‑experience remains unknown.

Given the combination of brand impersonation, association with a cryptocurrency scam, flagged detections, and presence on security blocklists, defenders should treat arb.airdropalerts.pro as a high‑confidence malicious indicator. Recommended actions include adding the domain to network‑level blocklists, updating URL filtering policies in web proxies, and sharing the indicator with threat‑intelligence feeds. Continuous monitoring of the IP address 142.250.185.164 is advised, as the infrastructure may be reused for future campaigns.