ath[.]airdropalerts[.]pro

Analysis of ath.airdropalerts.pro indicates a high‑confidence brand‑impersonation threat targeting Google users. The domain, created on 27 November 2025 and registered through Dynadot LLC, resolves to IP address 142.250.185.164, which belongs to AS15169 owned by Google LLC in the United States. Leveraging a legitimate Google IP range is a common tactic to increase trustworthiness, but the site lacks an SSL certificate, exposing any traffic to potential interception and confirming an insecure configuration. The HTTP response presents a page title of "Google," directly mirroring the targeted brand and aligning with the reported scam type of a crypto‑related fraud.

VirusTotal records show that seven out of ninety‑three scanning engines have flagged the domain, providing independent corroboration of malicious intent. Additional reputation data includes a Gridinsoft trust score of 0 / 100 and a listing on a single security blocklist, while PhishDestroy has already taken the domain offline. Nameserver records point to Cloudflare infrastructure (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a service frequently abused for fast‑flux or proxying malicious content.

The current offline status limits immediate observation of payload or phishing pages, leaving the exact delivery mechanism uncertain. Defenders should proactively block resolution of ath.airdropalerts.pro at the DNS level, enforce HTTPS‑only policies for any traffic to the domain, and add the domain to internal and external blocklists. Continuous monitoring of the associated IP address for any new malicious activity is advised, as the use of a legitimate Google IP suggests potential future attempts to exploit the same infrastructure.