op[.]airsdropsalert[.]lol

Analysis indicates that the domain op.airsdropsalert.lol was registered on 5 November 2025 through Dynadot LLC and is hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The site resolves to IP 172.217.18.4, which belongs to AS15169 owned by Google LLC and is located in the United States. No TLS certificate was observed, and the HTTP service was reported as taken offline at the time of analysis. The page title returned by the server is “Google,” matching the declared brand target and confirming the classification as a brand‑impersonation campaign.

The domain appears on a single security blocklist and has been flagged by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal scans show six of ninety‑five security vendors flagging the domain, providing additional corroboration of its hostile nature.

The limited detection footprint and the lack of a TLS certificate suggest a short‑lived operation designed to exploit the trusted Google IP space. Because the infrastructure leverages a legitimate Google address, defenders should not rely solely on IP reputation; instead, they should implement domain‑level blocking, monitor DNS queries for op.airsdropsalert.lol, and apply URL filtering based on the observed page title “Google.” Continuous re‑scanning of the domain is recommended in case the site becomes active again, and any future content should be examined for credential‑harvesting forms or redirects. Organizations using Google services should be aware of this impersonation attempt and educate users to verify URLs before entering credentials.