metis[.]airsdropsalert[.]lol

Analysis of metis.airsdropsalert.lol indicates that the domain was actively used for brand impersonation targeting Google. The site resolved to the IP address 142.251.140.164, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the domain itself is unrelated to Google; it was registered through Dynadot LLC on November 5, 2025 and is serviced by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, meaning the site was served over plain HTTP.

The page title returned by the server was the single word "Google," matching the declared brand target. VirusTotal records show that seven of ninety‑five scanning engines flagged the domain as malicious, and the domain is listed on the PhishDestroy blocklist, which contributed to its current offline status. The combination of brand‑specific page title, lack of encryption, and detection by multiple security vendors suggests a deliberate attempt to deceive users into believing the site is affiliated with Google. However, the exact content displayed on the page has not been captured, leaving the specific phishing vector (e.g., credential‑stealing login form) unconfirmed.

Defenders should add the domain to internal blocklists, monitor DNS queries for the IP 142.251.140.164 for any anomalous traffic, and enforce HTTPS‑only policies to prevent accidental connections to non‑TLS sites. Network sensors should also flag any HTTP requests that include the "Google" page title from this domain. Because the infrastructure uses Cloudflare, future iterations may leverage different subdomains or IP addresses, so continuous threat‑intel feeds should be consulted for updates. The elevated risk rating reflects the brand impersonation nature and the presence of multiple vendor detections, warranting proactive mitigation.