polkadot[.]airdrpalert[.]click

The domain polkadot.airdrpalert.click was registered on October 30, 2025 through Dynadot LLC and resolves to the IP address 142.250.186.36, which belongs to AS15169 (Google LLC) in the United States. The site presents a page title of "Google" and is classified as a brand impersonation campaign targeting the Google brand. Infrastructure analysis shows the domain is served by Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and does not host an SSL certificate, indicating only HTTP access was available at the time of observation. The domain has been flagged by 15 of 95 security vendors on VirusTotal, and it appears on one external security blocklist.

PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is recorded as 0 out of 100, reflecting a high confidence in malicious intent. The current operational status is offline, and no live content could be retrieved for deeper content inspection. Defenders should continue to block the domain at network perimeter and DNS layers, add the host to internal blocklists, and monitor for any future re‑registration or use of the same IP range.

Because the domain leverages a legitimate Google IP address, additional scrutiny of traffic to that address is recommended to differentiate legitimate Google services from this impersonation attempt. Observers should also watch for similar domains using the "airdrpalert" sub‑domain pattern, as the naming convention may indicate a broader campaign. Continuous threat‑intel feeds should be consulted for any updates on detection counts or new indicators of compromise related to this infrastructure.