eul[.]app-airdropalert[.]sbs

This domain eul.app-airdropalert.sbs was registered on 10 November 2025 through Dynadot LLC and is currently taken offline. It resolves to the IPv4 address 142.251.140.164, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet it does not present an SSL/TLS certificate, indicating that any HTTPS request would be rejected or downgraded to plain HTTP. The page title returned from the site is “Google”, matching the declared brand target and confirming that the adversary intends to impersonate Google.

The site has been classified as a crypto‑related scam, and 15 of 95 security vendors on VirusTotal have flagged it as malicious. It appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed. Independent reputation scoring from Gridinsoft rates the domain at 0 out of 100, reflecting a complete lack of trust. No additional public analysis of the landing page content is available, and the short‑lived offline status prevents active verification of payloads or credential‑harvesting forms.

Defenders should continue to block the domain at network egress points, monitor DNS queries for the eul.app‑airdropalert.sbs label, and add the IP address 142.251.140.164 to host‑based deny lists, despite its association with legitimate Google infrastructure. Because the domain leverages legitimate Cloudflare name servers and a Google‑owned IP range, static blocklists may miss future re‑use; therefore, threat‑intel teams should correlate any future queries to this domain with the observed pattern of brand‑impersonation and crypto‑scam indicators. Ongoing observation of the PhishDestroy and other phishing feeds is recommended to detect potential re‑activation.