eth[.]app-airdropalert[.]lol

The domain eth.app-airdropalert.lol was registered on November 10, 2025 through Dynadot LLC and is presently taken offline. Technical analysis shows that the zone is delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and resolves to the IP address 142.250.185.164, which belongs to AS15169 Google LLC in the United States. No TLS certificate is presented, indicating that the site does not serve HTTPS content. The HTTP response delivers a page whose title is simply "Google," matching the declared brand target of Google and confirming a brand‑impersonation intent.

The domain is classified as a crypto scam, and it has been flagged by 15 of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, and the current offline status suggests that the malicious infrastructure has been disrupted or removed.

While the IP address is owned by Google’s own network, the use of Cloudflare DNS and the lack of a valid SSL certificate are consistent with typical phishing‑hosting patterns. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address to reputation feeds despite its legitimate ownership, because the association with a brand‑impersonating payload remains a risk. Further investigation into any residual DNS records or cached content is recommended to confirm that no residual malicious artifacts remain.