sxt[.]airdropsalert[.]us

Analysis indicates that the domain sxt.airdropsalert.us was registered on October 18 2025 through Dynadot LLC and is currently marked as offline. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the domain is delegated to Cloudflare’s DNS infrastructure. DNS resolution points to the IPv4 address 192.178.155.99, which is announced by AS15169, the Google LLC network, situating the host in the United States. No TLS certificate is presented for the domain, and the HTTP response does not deliver an HTTPS endpoint, which is inconsistent with typical Google branding that enforces HSTS.

The page title returned by the server is simply “Google”, confirming an attempt to masquerade as the Google brand. VirusTotal has recorded 13 detections out of 93 scanned engines, reflecting a moderate level of malicious confidence among security vendors. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. The identified scam type is a crypto‑related scheme, suggesting that the site may have been used to lure victims into cryptocurrency transactions under the guise of a Google‑branded offering.

While the IP address belongs to Google’s infrastructure, the use of a Cloudflare‑managed domain and the lack of a valid SSL certificate point to a likely abuse of legitimate hosting resources rather than a compromise of Google’s own services. Defenders should continue to block the domain at network perimeter, update URL filtering policies, and monitor for any resurgence of activity. Additional scrutiny of outbound traffic to the associated IP range is advised, as well as correlation with any phishing email campaigns that reference the “airdropsalert” keyword. Because the site is offline, a snapshot of its content may be retrieved from web archives for forensic analysis, but the current evidence already supports classification as a brand‑impersonation crypto scam with elevated risk.