bob[.]airsdropsalert[.]lol

The domain bob.airsdropsalert.lol was registered on November 5, 2025 through Dynadot LLC and is currently hosted on infrastructure that resolves to IP address 142.250.184.228, which belongs to AS15169 Google LLC in the United States. The domain uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but does not present an SSL/TLS certificate, leaving the connection unencrypted. The page title returned by the web server is "Google," directly matching the advertised brand target and confirming that the domain is intended to impersonate Google.

Detection services have flagged the domain: seven of ninety‑five VirusTotal scanners reported malicious activity, and the domain is listed on a single security blocklist. It has also been blocked by the PhishDestroy service, indicating that external mitigation platforms have identified it as a threat. The domain’s current status is offline, which limits immediate observation of any payload or credential‑harvesting page, but the existing infrastructure evidence is sufficient to classify the site as a brand‑impersonation vector.

Uncertainty remains regarding the exact content served when the site was live, as no page snapshot is available and no SSL certificate can be examined for hidden payloads. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and name servers, and enforce TLS inspection policies to detect any future attempts to serve content from this host. Continuous re‑evaluation of the IP reputation is advised, given its association with Google’s own autonomous system, to avoid false positives while maintaining vigilance against potential abuse.