op[.]airdropalerts[.]bond

Analysis of op.airdropalerts.bond indicates a brand‑impersonation campaign targeting Google users. The domain was registered through Dynadot LLC on 14 October 2025 and uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. Its sole HTTP response presents the page title “Google”, matching the declared brand target, but the site lacks an SSL certificate, leaving the connection unencrypted. Infrastructure points to the IP address 142.250.185.100, which belongs to AS15169 Google LLC in the United States, suggesting the attacker deliberately leveraged a legitimate Google‑owned address to increase credibility. The domain currently resolves to that IP but is reported as taken offline, and PhishDestroy has already blocked it.

Reputation services provide minimal trust: Gridinsoft assigns a score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal scans show that 2 of 95 antivirus or URL‑reputation engines flagged the domain, confirming that at least some detection products consider it malicious. The scam type is identified as a “Fake Airdrop”, implying that victims may have been lured with promises of free cryptocurrency distributions. No TLS certificate, low trust score, and the alignment of page title with the targeted brand are consistent with typical impersonation tactics. Uncertainties remain regarding the full payload delivered when the site was active, as no HTTP status code or content details have been captured.

The exact nature of any malicious code and whether additional command‑and‑control infrastructure were used cannot be verified from the available data. Defenders should therefore treat any traffic to op.airdropalerts.bond as hostile. Immediate actions include adding the domain to internal blocklists, confirming that DNS resolvers return NXDOMAIN or a sinkhole response, and monitoring for any outbound connections to the associated IP address.