metis[.]app-airdropalert[.]lol

On July 23, 2026, the domain metis.app-airdropalert.lol was observed to be taken offline. The domain was registered through Dynadot LLC on November 10, 2025 and points to the IP address 142.250.186.132, which belongs to AS15169 Google LLC in the United States. The site presented a page title of "Google", indicating an attempt to impersonate the Google brand. No TLS certificate was served, confirming the absence of HTTPS protection.

The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both owned by Cloudflare. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis returned 15 positive detections out of 95 scanned antivirus and URL‑reputation engines, reinforcing the malicious classification. The observed scam type is a crypto‑related scam, although the exact payload or lure was not captured.

Because the site is offline, automated checks such as HTTP status and content retrieval could not be performed, leaving the precise page content unknown. Defenders should continue to monitor the IP address for any re‑use, enforce blocklisting of the domain in network and endpoint controls, and consider adding the associated IP range to threat‑intel feeds. Additional investigation may focus on any residual DNS records, potential reuse of the Cloudflare nameservers, and correlation with other crypto‑scam campaigns that target Google users.